Same query, different week: how much a ZoomEye total actually moves

An index total is a snapshot, and the snapshot has an age. Six products measured repeatedly between 23 September and 27 October 2026 show what that means in practice: most counts drift by well under one percent over a month, one went down, and one did not move at all in a day.

The series

Each figure below is the app= total for the same query, recorded on the date shown. The 27 October values were measured for this article between 18:07Z and 18:15Z.

• Netdata: 607,266 (24 Sep), 607,286 (27 Sep), 607,389 (07 Oct), 607,431 (12 Oct), 607,439 (13 Oct), 607,563 (27 Oct)
• MinIO: 259,663 (05 Oct), 260,246 (08 Oct), 261,364 (18 Oct), 261,578 (19 Oct), 261,785 (27 Oct)
• Webmin: 213,171 (23 Sep), 214,955 (17 Oct), 214,996 (27 Oct)
• Consul: 78,129 (04 Oct), 78,194 (08 Oct), 78,224 (18 Oct), 78,233 (25 Oct), 78,241 (27 Oct)
• EMQX: 2,951 (10 Oct), 2,949 (13 Oct), 2,947 (27 Oct)
• Cockpit: 6,767 (26 Oct), 6,767 (27 Oct) A separate check within minutes: app="Cisco Identity Services Engine" returned 976,933 and then 976,936 in back-to-back queries on 27 October.

What the numbers show

Convert the endpoints to a monthly rate and the picture is consistent. MinIO moved from 259,663 to 261,785 in 22 days, which is 0.82 percent. Webmin moved 0.86 percent in 34 days. Consul moved 0.14 percent in 23 days. Netdata moved 0.05 percent in 33 days.
Each of those is a slow crawl, and the crawl is what a growing install base looks like when the query is stable. None of them is a jump large enough to suggest a change in the measurement method or a new source of coverage.
EMQX is the exception in the other direction: 2,951 to 2,947 over 17 days, a fall of 0.14 percent. A decrease is worth pausing on, because the intuitive reading is that somebody remediated. Four assets is far too small a movement to support that conclusion. Attrition happens for mundane reasons too: a host is decommissioned, a container is rebuilt without the same signature, a network is re-addressed, a crawler's coverage shifts, a page that carried the string stops being indexed.
Cockpit returning the identical 6,767 on two consecutive days is the useful control. A count that does not move at all is not broken; it is what a stable population looks like between crawls.

The within-minutes variation

976,933 then 976,936 is a three-asset difference across two queries seconds apart. That is ordinary: the index is being written to while it is being read, and a scan that completes between the two queries adds records. It sets a floor on the precision of any single figure, and the floor is small enough to ignore for planning and large enough to matter for a claim.
The practical consequence: a total should be quoted with the date it was taken, and a difference smaller than a few dozen assets should never be presented as a trend. Three assets is noise. Three thousand is a signal.

Why the drift rate matters

The reason to care about sub-one-percent monthly movement is that it makes a single measurement good enough for most decisions, and it makes over-interpretation the larger risk.
If MinIO's population grows 0.8 percent a month, then a count taken seven weeks ago overstates the present by about 1.4 percent, which does not change any remediation priority. If a report claims a 40 percent surge, the surge is almost certainly a change in the query, the sub-type or the indexing method rather than a change in the world. The series above is what an actual change looks like over that window, and it is flat.
The corollary for anyone reusing another article's number: check the date and the field. A figure of 259,663 for MinIO is not wrong, it is a 5 October reading, and using it as a current total overstates by roughly 0.8 percent. That is acceptable in prose and unacceptable in a table that says "current".

A method that survives review

Record the dork verbatim, the sub-type, the timestamp to the minute and the total. Keep the series. Then, when a number needs to appear in a decision document, state the date next to it and state the direction of drift if it is known.
Three practical habits follow from the six series above:

• Prefer differences of more than one percent before treating a change as real.
• Re-run the query before publishing rather than reusing a figure from an older draft.
• Where a count does not move between two runs, treat that as stability rather than as a caching fault. None of this makes the numbers more precise than they are. It makes the claims attached to them defensible, which is the part that gets tested.

References

• ZoomEye app= totals recorded 2026-09-23 through 2026-10-27 for Netdata, MinIO, Webmin, Consul, EMQX, Cockpit and Cisco Identity Services Engine; the 27 October values were queried 18:07Z to 18:15Z with pagesize=1
• ZoomEye documentation on the total field and on sub-types (app, title, web, all)
• Consecutive-query check on app="Cisco Identity Services Engine": 976,933 then 976,936 on 2026-10-27T17:35Z