Alert threshold "count()" wrong numbers

## Expected Behavior
When creating an alert for a message to cross a threshold in a given time by using the Aggregation -> count() definition and setting the search range to a defined value an alert should be produced.
The count() function should count the amount of given events in the given time range.

## Current Behavior
The count() function produces absurd numbers. Message Replay delivers no results aswell as manual search.
Alerts are triggered although alert condition does not match.

## Steps to Reproduce (for bugs)

1. Create new Alert
2. Enable Aggregation and threashold
3. Set condition to count()
4. See number of counts

## Context

I am trying to set up an alert for when there is a high number of failed logins to our VPN. I want to achive this by counting those exact messages from our firewall. Although no events were logged, the count() function returns absurdly high numbers

## Your Environment

* Graylog Version: 6.3.4
* Java Version: -
* OpenSearch Version: 2.16.0
* MongoDB Version: 6.0
* Operating System: Ubuntu 24.04
* Browser version:

## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?