Getting Data In

Best Practice for Gauging the Amount of Data Ingested Daily


What is the best method for gauging the amount of data a log source feeds in? for example, let the system send data to the indexer(s) for a set period of time i.e. 24 hours ?

0 Karma


That's the method I use. Depending on the source, you may not need to leave it running for 24 hours as sometimes an hour or two is enough for an estimate.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!