Inconsistent Predict results

[rahulgopal]

Hi

When I compare the dashboard results for these two simultaneously executed searches below:

(i) malware in last 60 minutes

(ii) malware in last 4 hours

and view the count of occurrences for the same date/timestamp, the occurences count is reported very differently, as follows:

(i) malware in last 60 minutes -> count=49

(ii) malware in last 4 hours -> count=106

Attached are the screenshots below:

![4 hours][C:\Temp\4_hrs.jpg]

![60 mins][C:\Temp\60_mins.jpg]

Why this discrepancy?

[jordanperks · Accepted solution]

I cannot see the jpgs. Can you post your search?

[jordanperks]

My initial thought is differing bucket sizes. 1 hour vs 1 day or something of that nature. In your search are you statically defining your bucket sizes? Something like this?

| bucket span=1h _time | timechart span=1h count(foo) as count

[rahulgopal]

I've uploaded the jpgs here:

https://www.dropbox.com/s/790dnsdy0bwscb6/4_hrs.jpg

https://www.dropbox.com/s/b6kjx901tuxr86k/60_mins.jpg