That is the reason why you consolidate the orders in the first place, let´ s say you have 6 orders happening at the same second and they sum up to 2000, 20 seconds later you have another burst summing 1000 lots, and 1min later you have another burst with 1500, so in less than 5min you already have a consolidated order of 4500 lots, which you can only see clearly by merging the orders that happen inside the same second or a bit more, or even in 1minute. Depending on the market you have to adjust the filter size and order consolidation time interval for that market, but you can only do that by watching time and sales to see what is normal and what is anomaly.