All Apps and Add-ons

Inconsistent Predict results

rahulgopal
Explorer

Hi

When I compare the dashboard results for these two simultaneously executed searches below:

(i) malware in last 60 minutes

(ii) malware in last 4 hours

and view the count of occurrences for the same date/timestamp, the occurences count is reported very differently, as follows:

(i) malware in last 60 minutes -> count=49

(ii) malware in last 4 hours -> count=106

Attached are the screenshots below:

![4 hours][C:\Temp\4_hrs.jpg]

![60 mins][C:\Temp\60_mins.jpg]

Why this discrepancy?

0 Karma
1 Solution

jordanperks
Path Finder

I cannot see the jpgs. Can you post your search?

View solution in original post

0 Karma

jordanperks
Path Finder

I cannot see the jpgs. Can you post your search?

0 Karma

jordanperks
Path Finder

My initial thought is differing bucket sizes. 1 hour vs 1 day or something of that nature. In your search are you statically defining your bucket sizes? Something like this?

| bucket span=1h _time | timechart span=1h count(foo) as count

0 Karma

rahulgopal
Explorer
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...