I executed this search on my data, over two different time ranges:
"malware" | timechart count
The time ranges were:
1) Last 4 hours
2) Last 60 minutes
The event count in the results, for a selected specific time stamp, were differently reported by the two searches above.
For instance, for the selected time of 10:45 am in the search results:
1) "Last 4 hours" reported the event count as 194
2) "Last 60 minutes" reported the event count as 32
Why this huge discrepancy ?
The discrepancy is caused by the differing bucket spans. Without specifying anything, a four-hour timechart will use buckets that span five minutes while a one-hour timechart will use buckets that span one minute.
If you add up the one-hour timechart's buckets for :45, :46, :47, :48, and :49 you will get 194.
The discrepancy is caused by the differing bucket spans. Without specifying anything, a four-hour timechart will use buckets that span five minutes while a one-hour timechart will use buckets that span one minute.
If you add up the one-hour timechart's buckets for :45, :46, :47, :48, and :49 you will get 194.
I found the issue on Splunk v5.0.3, and also on Splunk v6.
The screenshots from Splunk v6 can be accessed at:
1) Last 4 hours
https://www.dropbox.com/s/2ogseohypers9oy/count_4_hrs_Splunk6.jpg
2) Last 60 minutes
https://www.dropbox.com/s/9gjrlj3651iyz5d/count_60_mins_Splunk6.jpg
Upon further investigation, it appears it may be a bug in the Splunk search itself.
See my post about it at - "http://answers.splunk.com/answers/116526/conflicting-event-count-in-search-app-based-upon-time-range"
The screenshots can be accessed here:
1) Last 4 hours
https://www.dropbox.com/s/nfncfxdrd5elqc7/count_4_hrs.jpg
2) Last 60 minutes
https://www.dropbox.com/s/4qfm3kon3uem6g7/count_60_mins.jpg