Merge pull request #643 from MicrosoftDocs/main

Publish main to live, 06/07, 3:30 PM IST

Author: aditisrivastava07

defender-xdr/streaming-api-event-hub.md

@@ -113,22 +113,18 @@ To get the data types for event properties, do the following steps:
   :::image type="content" source="/defender-endpoint/media/machine-info-datatype-example.png" alt-text="An example query for device info" lightbox="/defender-endpoint/media/machine-info-datatype-example.png":::
 
 ## Estimating initial Event Hub capacity
-The following advanced hunting query can help provide a rough estimate of data volume throughput and initial event hub capacity based on events/sec and estimated MB/sec. We recommend running the query during regular business hours so as to capture 'real' throughput.
+The following Advanced Hunting query can help provide a rough estimate of data volume throughput and initial event hub capacity based on events/sec and estimated MB/sec. We recommend running the query during regular business hours so as to capture 'real' throughput.
 
 ```kusto 
-let bytes_ = 1000;
-union withsource=MDTables MyDefenderTable // TODO: Insert desired tables one by one separated by a comma (for example: DeviceEvents, DeviceInfo) or with a wildcard (Device*)
-| where Timestamp > startofday(ago(7d))
+let bytes_ = 500;
+union withsource=MDTables *
+| where Timestamp > startofday(ago(6h))
 | summarize count() by bin(Timestamp, 1m), MDTables
 | extend EPS = count_ /60
-| summarize avg(EPS), estimatedMBPerSec = avg(EPS) * bytes_ / (1024*1024) by MDTables, bin(Timestamp, 3h)
-| summarize avg_EPS=max(avg_EPS), estimatedMBPerSec = max(estimatedMBPerSec) by MDTables
+| summarize avg(EPS), estimatedMBPerSec = (avg(EPS) * bytes_ ) / (1024*1024) by MDTables
 | sort by toint(estimatedMBPerSec) desc
-| project MDTables, avg_EPS, estimatedMBPerSec
 ```
 
-To check the different Event Hub limits, review [Azure Event Hubs quota and limits](/azure/event-hubs/event-hubs-quotas).
-
 ## Monitoring created resources
 
 You can monitor the resources created by the streaming API using **Azure Monitor**.