All Apps and Add-ons

Inconsistent Predict results

rahulgopal
Explorer

Hi

When I compare the dashboard results for these two simultaneously executed searches below:

(i) malware in last 60 minutes

(ii) malware in last 4 hours

and view the count of occurrences for the same date/timestamp, the occurences count is reported very differently, as follows:

(i) malware in last 60 minutes -> count=49

(ii) malware in last 4 hours -> count=106

Attached are the screenshots below:

![4 hours][C:\Temp\4_hrs.jpg]

![60 mins][C:\Temp\60_mins.jpg]

Why this discrepancy?

0 Karma
1 Solution

jordanperks
Path Finder

I cannot see the jpgs. Can you post your search?

View solution in original post

0 Karma

jordanperks
Path Finder

I cannot see the jpgs. Can you post your search?

0 Karma

jordanperks
Path Finder

My initial thought is differing bucket sizes. 1 hour vs 1 day or something of that nature. In your search are you statically defining your bucket sizes? Something like this?

| bucket span=1h _time | timechart span=1h count(foo) as count

0 Karma

rahulgopal
Explorer
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...