@@ -92,12 +92,21 @@ _index=sumologic_audit_events minuteVolume stopCollecting
92921 . Identify sources which are not critical data sources where stricter data controls can be added to prevent your organization from being throttled.
93931 . Identify ` _sourceCategory ` or any other identifier for the sources.
94941 . Run the following query. The goal of this query is to understand previous data ingestion trends and suggest to you the peak volume seen per minute.
95- ``` sql
96- {Your scope for data, example: _sourceCategory= alpha }
97- | timeslice 1d
98- | sum (_size) as datasize by _timeslice
99- | sort by datasize desc
100- | limit 1
95+ ``` sql
96+ _sourceCategory=< source category> AND _index=< partition name>
97+ | timeslice 1m
98+ | sum (_size) as bytes by _timeslice
99+ | bytes/ 1Mi as mbytes
100+ | formatDate(_timeslice, " yyyy-MM-dd" ) as dateslice
101+ | max (mbytes) as max_mb_per_min by dateslice
102+ | round(max_mb_per_min, 2 ) as max_mbpmin
103+ | round(max_mb_per_min * 1 .1 , 2 ) as %" max_mbpmin_110%"
104+ | round(max_mb_per_min * 1 .2 , 2 ) as %" max_mbpmin_120%"
105+ | round(max_mb_per_min * 1 .5 , 2 ) as %" max_mbpmin_150%"
106+ | round(max_mb_per_min * 1 .75 , 2 ) as %" max_mbpmin_175%"
107+ | round(max_mb_per_min * 2 , 2 ) as %" max_mbpmin_200%"
108+ | sort by dateslice asc
109+ | fields - max_mb_per_min
101110 ```
1021111 . Keep this value and add a 10% to 15% buffer while setting up ** Minute Volume** ingest budgets.
1031121 . Complete ingest budget setup.
0 commit comments