Keep in mind that the database takes into considerations all events (IPS, File, Network Discovery, etc.) and not just connection events. Check those as well and see if the math adds up. In general, it is a good practice to get a SIEM solution such as Splunk and utilize the eStreamer to punt events to it.
Thank you for rating helpful posts!
