Second, I think you should be able to do this in one search instead of three. And I'm not sure if your current search is accurate either? I'm assuming your verifying the numbers, but since your first search looks at all data since 2 months ago, it seems like it it's including counts from today. It doesn't look like you're doing anything to actually limit the risk value calculation to 2 months ago.
Meaning, your stats is doing its calculations across every event being returned. Sure, the Etime will resolve to the first month because that's what you're telling it, but you're not actually limiting your counts to that month.
If the goal is to get the risk values over time by month, then I think this would be better accomplished with a combination of bucket _time span=1mon and stats or timechart span=1mon. But I don't understand the data set enough to create an accurate search. For example, i'm not sure why you're deduping events before doing your counts. And I'm not sure why your searches start 3 weeks into the month.
But I hope this helps a little.
... View more