Merge branch 'main' into docs-569-add-cloud-siem-course-content

jpipkin1 · web-flow · commit 290a91df5e1f · 2024-12-09T09:10:34.000-06:00
diff --git a/blog-service/2024-12-09-search.md b/blog-service/2024-12-09-search.md
@@ -0,0 +1,16 @@
+---
+title: compareCIDRPrefix and getCIDRPrefix Operators Behavior Change (Search)
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - compareCIDRPrefix
+  - getCIDRPrefix
+  - search-operator
+  - log-search
+hide_table_of_contents: true  
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-service/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+We are happy to announce the behavioural change for the [`compareCIDRPrefix`](/docs/search/search-query-language/search-operators/cidr/#comparecidrprefix) and [`getCIDRPrefix`](/docs/search/search-query-language/search-operators/cidr/#getcidrprefix) operators. Previously, these operators would fail if there were trailing or leading spaces around the IP address. With this update, the `compareCIDRPrefix` and `getCIDRPrefix` operators have become more flexible and can do trimming, which means the operators will not fail even if there are trailing or leading spaces around the IP address.
diff --git a/docs/integrations/sumo-apps/data-volume.md b/docs/integrations/sumo-apps/data-volume.md
@@ -11,24 +11,6 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
 
 The Data Volume App provides you with a summary and detailed views of your account's data usage volume by data type, tier, category, collector, source name, and hosts via predefined searches and dashboards.
 
-Before you can install and use the Data Volume app, an administrator must first enable the feature. For more information, see [Enable the Data Volume Index](#enable-the-data-volume-index) below.
-
-The Data Volume Index gathers volume data as soon as it is enabled. It will not gather data from legacy versions or backfill data.
-
-
-## Enable the Data Volume Index
-
-The Data Volume Index must be enabled by an administrator.
-
-To enable the Data Volume Index:
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Account > Data Management**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Administration**, and then under **Account** select **Data Management**. You can also click the **Go To...** menu at the top of the screen and select **Data Management**.
-1. Under **Data Volume**, select **Enable**.
-
-<img src={useBaseUrl('img/manage/ingestion-volume/data_volume_check_box.png')} alt="Enable Data Volume Index" style={{border: '1px solid gray'}} width="800"/>
-
-A message confirms that the feature is enabled.
-
 ## Installing the Data Volume app
 
 import AppInstallNoDataSourceV2 from '../../reuse/apps/app-install-index-apps-v2.md';
diff --git a/docs/manage/security/audit-indexes/search-audit-index.md b/docs/manage/security/audit-indexes/search-audit-index.md
@@ -59,7 +59,7 @@ The following table provides details on the fields returned by the index:
 | `content_identifier` | The ID of the content item that triggered the search query. |
 | `content_name` | The name of the content item that triggered the search query. |
 | `data_retreived_bytes` | Amount of data retrieved by the search query. This represents the approximate size of messages that match the source expression of the query and are retrieved from scanning. |
-| `data_scanned_bytes` | Amount of data scanned by the search query. This value is an approximation, as the scanned message bytes are captured at intermittent time intervals and then averaged over the query time range. It is important to note that this value may be less than the retrieved bytes in some cases due to the approximation. Additionally, if a query contains a `timecompare` or `subquery` operator, the `data_scanned_byte` attribute in the audit log will include the sum of both the parent and child queries. |
+| `data_scanned_bytes` | Displays the total sum of scanned bytes for charged (Flex and Infrequent bytes) and non-charged metering types (Continuous and Frequent bytes). This value can be different from what users see in scan estimates on UI. Additionally, if a query contains a `timecompare` or `subquery` operator, the `data_scanned_byte` attribute in the audit log will include the sum of both the parent and child queries. |
 | `execution_duration_ms` | Time taken to complete the search. |
 | `is_aggregate` | The boolean variable that indicates if the corresponding search query was an aggregate query. The aggregate operator’s list can be found in [Group or Aggregate Operators](/docs/search/search-query-language/group-aggregate-operators). |
 | `query` | The query text string run by the user. |
@@ -74,6 +74,7 @@ The following table provides details on the fields returned by the index:
 | `session_id` | An identifier for every search run within the account. This is the same SESSION number displayed in the UI in the search tab. |
 | `status_message` | Gives the status of the search. The values include: **Finished successfully**, **Query failed**, and **Query canceled**. |
 | `user_name` | The email of the user that ran the search. |
+| `scanned_bytes_breakdown_by_metering_type` | Displays breakdown of the total amount of data scanned by a search query based on the metering type. It includes both charged metering types (Flex and Infrequent bytes) and non-charged metering types (Continuous and Frequent bytes). |
 
 ## Query type field values 
 
diff --git a/docs/metrics/metrics-dpm.md b/docs/metrics/metrics-dpm.md
@@ -7,7 +7,7 @@ description: Metrics Data Ingestion allows you to view metrics ingest volumes ac
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-You can view your metrics data ingestion volume on the **Metrics Data Ingestion** page. This page provides a granular breakdown of your metrics ingestion and credits used. You can track consumption by individual metric names, or by specific dimensions and sources. With this data, you can see which sources and metrics contribute most to your credit consumption, and take necessary action. 
+You can view your metrics data ingestion volume on the **Metrics Data Ingestion** page. This page provides a granular breakdown of your metrics ingestion. You can track consumption by individual metric names, or by specific dimensions and sources. With this data, you can see which sources and metrics contribute most to your credit consumption, and take necessary action. 
 
 Understanding the volume of metrics that you are ingesting is important because when you exceed the credit limit, data is cached on the host and the source is throttled, reducing query performance and accuracy. For more information, see [Data Limits for Metrics](/docs/metrics/manage-metric-volume/data-limits-for-metrics/).
 
diff --git a/docs/search/search-query-language/search-operators/cidr.md b/docs/search/search-query-language/search-operators/cidr.md
@@ -4,7 +4,7 @@ title: cidr Search Operator
 sidebar_label: CIDR
 ---
 
-Sumo Logic's three CIDR operators work with CIDR (Classless Inter-Domain Routing, sometimes pronounced "cider") notation to narrow the analysis of IPv4 networks to specific subnets. CIDR notations specify the routing prefix of IP addresses.
+Sumo Logic's three CIDR operators work with CIDR (Classless Inter-Domain Routing, sometimes pronounced "cider") notation to narrow the analysis of IPv4 networks to specific subnets. CIDR notations specify the routing prefix of IP addresses. Input data will be trimmed, making these operators more flexible, which allows you to set your expectations accordingly.
 
 Using the CIDR operators, you can determine the amount of traffic between network segments, review events from hosts within a specified network segment, or even use a not operator to find addresses that didn't originate from a particular network segment. CIDR operators can be used to compare the network segment of two IPv4 addresses, or just identify the network segment involved in particular messages.
 
