Inconsistencies with Reporting Output

[VishamRawat]

As evidence, I've attached snapshots of 3 reports, all with differing output. I queried SA for a particular report, and the results are as follows.

1. 4 days = 131 results

2. 96 hours (4 days) = 130 results

3. 4 months = 3 results

Why this fluctuation and inconsistency? I'm unable to make sense of it. There are many more examples. For instance, 7 days = 96 results, and 168 (7 days) hours = 117 results. Why? and how come the more I increase the time range, the fewer the results?

I hope I'm not missing something here, 'coz logically the output fluctuation (lack or increase of) makes no sense to me. Eric Partington‌

RSA Security Analytics 10.6" data-type="space‌

RSA Security Analytics 10.6.4" data-type="space‌

[Anonymous]

Hi Visham,

Check the time range of the actual report results.  The different reports are not overlapping time ranges as you're probably expecting. Past 4 months is the past 4 whole months, so beginning of April to end of July.  Past 4 days is midnight 4 days ago to midnight last night.  etc.

You need to check 'Use relative time calculation' so that they all end at the time the report is run and past X is from that point instead of the last whole hour, last whole day, or last whole month.

Thanks,

Guy

[DaveGlover]

Visham

Are you able to schedule the report vs run it in test.  When you schedule there might be a "results were truncated" in very small print under the report title.

Couple you try that?

Thansk

Dave

[VishamRawat]

Nope, no 'results were truncated' message. Besides, I've set the limit in the rule builder as 200.

Still some inconsistencies I can't quite fathom.

Please check my response on Guy's comment.

[VishamRawat]

Hi Guy,

I've tried the Relative Time Calculation.

It gave me a couple of accurate results when I checked the output for 7 days and 168 hours.

But, there's still something I don't get.

For past 7 days = 130 results;

past 168 hours = 130 results;

past 168 days = 9 results;

past 30 days = 40 results;

How can this be? I don't understand. I'm even using Relative Time Calculation this time.

If in the past 7 days, there are 130 results, shouldn't the results returned for 30 days be larger - inclusive of the 7 days output and the 23 days prior?