Different Results From Same Query

[jack_sumatra]

I have question.

Can anyone explain why same search query given different results in different time range?

This is time range between 2021-02-24, hour 08:00:00 to 10:59:59

This is time range between 2021-02-24, hour 09:00:00 to 09:59:59

Why the result on hour 09:00:00 different, one show 81 and the other one 387.

Thank you

[gcusello · Accepted solution]

Hi @jack_sumatra,

Have you the same events in both the time periods?

probably you have different events in the second one so you have a different result, it isn't a strange behaviour. 

Ciao.

Giuseppe

[gcusello]

Hi @jack_sumatra,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉