Alert Filtering

Hi-

Is there additional information anywhere on how the filters behave in alerting?

I would like to filter an alert based on a specific time or time frame segment.   However, when i add a filter for a specific hour or time frame segment (i.e  9am) 

the preview actually indicates significantly MORE alerts would have fired over the preview period.

Report example: hourly granualirty on revenue w/ below expected anomalies -  preview expects 5 in the last 7 days.

if I add a filter for a particular hour, or two,  the preview expects 40.

What would cause a filter to add more instances for the alert to fire?