Skip to content

Commit 9ddbf05

Browse files
JV0812jpipkin1
authored andcommitted
Update minute-volume.md (#4692)
1 parent b001828 commit 9ddbf05

File tree

1 file changed

+15
-6
lines changed

1 file changed

+15
-6
lines changed

docs/manage/ingestion-volume/ingest-budgets/minute-volume.md

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -92,12 +92,21 @@ _index=sumologic_audit_events minuteVolume stopCollecting
9292
1. Identify sources which are not critical data sources where stricter data controls can be added to prevent your organization from being throttled.
9393
1. Identify `_sourceCategory` or any other identifier for the sources.
9494
1. Run the following query. The goal of this query is to understand previous data ingestion trends and suggest to you the peak volume seen per minute.
95-
```sql
96-
{Your scope for data, example: _sourceCategory= alpha }
97-
| timeslice 1d
98-
| sum(_size) as datasize by _timeslice
99-
| sort by datasize desc
100-
| limit 1
95+
```sql
96+
_sourceCategory=<source category> AND _index=<partition name>
97+
| timeslice 1m
98+
| sum(_size) as bytes by _timeslice
99+
| bytes/1Mi as mbytes
100+
| formatDate(_timeslice, "yyyy-MM-dd") as dateslice
101+
| max(mbytes) as max_mb_per_min by dateslice
102+
| round(max_mb_per_min, 2) as max_mbpmin
103+
| round(max_mb_per_min * 1.1, 2) as %"max_mbpmin_110%"
104+
| round(max_mb_per_min * 1.2, 2) as %"max_mbpmin_120%"
105+
| round(max_mb_per_min * 1.5, 2) as %"max_mbpmin_150%"
106+
| round(max_mb_per_min * 1.75, 2) as %"max_mbpmin_175%"
107+
| round(max_mb_per_min * 2, 2) as %"max_mbpmin_200%"
108+
| sort by dateslice asc
109+
| fields -max_mb_per_min
101110
```
102111
1. Keep this value and add a 10% to 15% buffer while setting up **Minute Volume** ingest budgets.
103112
1. Complete ingest budget setup.

0 commit comments

Comments
 (0)