Difference between per_second and span=1s in timechart?

[Mattjj]

Hi all,

We are trying to show the bytes/s, averaged over 15 mins.  I'm getting far lower results if I use per_second than a live timechart with a span of 1s, so:

index="datafeed" | where isnotnull(bytes) | timechart span=15m per_second(bytes)

Gives an average of 10mb/s

Whereas:

index="datafeed" | where isnotnull(bytes) | timechart span=1s sum(bytes)

Shows the data constantly hovering around the 100mb/s mark, so the 15 min average must be up at that level.  Am I missing something obvious?  

Thanks for any pointers!