In Insights there are two attributes that look at the organization associated with a ticket. They are called "Organization" and "Ticket Organization".
Here is a targeted view of the Insights data model showing where each of these attributes are:
"Ticket Organization" refers to the organization listed on a ticket. The attribute is directly associated with the ticket, so you'll be able to see "Ticket Organization" in the agent interface and in the API endpoint for that ticket.
On the other hand "Organization" is connected to the "User" dataset. When you are looking at the "Organization" for a ticket, the system first looks at the requester (the "User"), and then checks the user's organization.
Since you're basing this on users, instead of tickets, you can't really look at historical data using "Organization". The "Organization" attribute will always look at the user's current organization value. If a user was in one organization, but then switched down the line to a different one, any reports based off of "Organization" will count tickets under that new org. This may be beneficial or detrimental depending on the situation.
If you have multi-org enabled, "Organization" only looks at a user's primary organization. Please select "Ticket Organization" for multi-org reporting.
One implication of this is if an end-user added several closed tickets without organizations, then Insights would show "(empty value)" for "Ticket Organization", no matter what. Once the user is added to an org, Insights will associate these closed tickets with the correct "Organization".
To reiterate, the "Ticket Organization" is the organization that is listed on the ticket. The "Organization" is the organization currently linked to the requester of the ticket.