Why does our Index firewall ingest more logs every Tuesday?

[Akdollar]

Hello

One of my company's firewall ingest more logs every tuesday to splunk which makes us go over the 10G limit per day for our subscription. This only happens every tuesday. Does any one knows what's the problem is, and how to bring the daily ingestion to uniformity?

Thanks for the help

E

[gcusello]

Hi @Akdollar,

a t first check if the data flow that on tesday exeeds is the firewall one, you can do it using the [Settings -- Licensing -- Usage Report -- Previous 60 days -- Split by index].

if it's  really this data flow, you should analyze if there's something different on Tuesday, but I don't know how to help you, because I sgould see your installation.

If it's a correct behavior, You could filter your data on tuesday discarding not relevant events.

ciao.

Giuseppe