topic XQL Query for calculating XDR log ingestion in Cortex XSIAM Discussions

XQL Query for calculating XDR log ingestion

PA_nts — Mon, 30 Jun 2025 06:35:38 GMT

Hi,
As this is covered by the XDR license and not visible in the data ingestion widgets..

Does anyone have a query to look at data ingestion for XDR agents only?

thanks in adv

Re: XQL Query for calculating XDR log ingestion

mavega — Wed, 09 Jul 2025 15:24:49 GMT

Hi,

Thanks for reaching out LC.

You can use the below query example below and filter by the product you want to view:

dataset = metrics_source
| fields _vendor , _product , total_size_bytes , total_size_rate
| comp sum(total_size_bytes ) as ingestion by _product
| alter Ingestion_by_MB = divide(round(multiply(divide(ingestion , pow(2,20)),10000)),10000)
| fields _product ,Ingestion_by_MB
| sort desc Ingestion_by_MB

Regards.

If you feel this answered your inquiry please mark As Solution.

Re: XQL Query for calculating XDR log ingestion

PA_nts — Thu, 10 Jul 2025 07:43:39 GMT

Thanks Mavega

..that does work.. but, it shows the metrics for xdrc - the xdr collector only. not xdr agents.

any ideas?

thanks

Re: XQL Query for calculating XDR log ingestion

A.Elzedy — Thu, 10 Jul 2025 16:53:45 GMT

I'm not aware of any log size's metrics for endpoints, but being familiar with the log counts per xdr agent should bring you closer to your goal

dataset = xdr_data | filter _product = "XDR agent" | comp count() as logs by agent_id , agent_hostname | sort desc logs

Re: XQL Query for calculating XDR log ingestion

kadirerol — Wed, 08 Apr 2026 08:48:21 GMT

dataset = metrics_source

|comp sum (total_size_bytes) as gunluk_total_bytes by _product //

|alter gunluk_ortalama_log_boyut_kb=divide (gunluk_total_bytes ,1024) //KB
|alter gunluk_ortalama_log_boyut_mb=divide (gunluk_ortalama_log_boyut_kb ,1024) //MB
|alter gunluk_ortalama_log_boyut_gb=divide (gunluk_ortalama_log_boyut_mb ,1024) // GB

you can use this query

Re: XQL Query for calculating XDR log ingestion

kadirerol — Wed, 08 Apr 2026 08:49:53 GMT

By the way How can we write an XQL query to calculate the total log volume for the last 24 hours in GB and check whether it is 20% higher than the previous day?