Getting Data In

Best Practice for Gauging the Amount of Data Ingested Daily


What is the best method for gauging the amount of data a log source feeds in? for example, let the system send data to the indexer(s) for a set period of time i.e. 24 hours ?

0 Karma


That's the method I use. Depending on the source, you may not need to leave it running for 24 hours as sometimes an hour or two is enough for an estimate.

If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!