Tailscale Premium: Subnet router throughput anomaly

Original query, unchanged.

let baselineDays = 7d;
let recent = 1h;
let multiplier = 3.0;
let recentTraffic =
    Tailscale_Network_CL
    | where TimeGenerated > ago(recent)
    | where HasSubnetTraffic
    | mv-expand t = SubnetTraffic
    | extend Bytes = tolong(t.txBytes) + tolong(t.rxBytes)
    | summarize RecentBytes = sum(Bytes) by NodeId, SrcNodeName, SrcUser, SrcOs, SrcTags=tostring(SrcTags);
let baseline =
    Tailscale_Network_CL
    | where TimeGenerated between (ago(baselineDays + recent) .. ago(recent))
    | where HasSubnetTraffic
    | mv-expand t = SubnetTraffic
    | extend Bytes = tolong(t.txBytes) + tolong(t.rxBytes)
    | summarize TotalBaselineBytes = sum(Bytes) by NodeId
    | extend BaselineHourlyBytes = TotalBaselineBytes / 168.0;
recentTraffic
| join kind=inner baseline on NodeId
| where RecentBytes > BaselineHourlyBytes * multiplier
| extend Multiplier = round(RecentBytes / BaselineHourlyBytes, 1), RecentMB = round(RecentBytes / 1024.0 / 1024.0, 2), BaselineHourlyMB = round(BaselineHourlyBytes / 1024.0 / 1024.0, 2)
| project NodeId, SrcNodeName, SrcUser, SrcOs, SrcTags, RecentMB, BaselineHourlyMB, Multiplier
| order by Multiplier desc