XQL Query for calculating XDR log ingestion

[PA_nts]

Hi, 
As this is covered by the XDR license and not visible in the data ingestion widgets..

Does anyone have a query to look at data ingestion for XDR agents only?

thanks in adv

[mavega]

Hi,

Thanks for reaching out LC.

You can use the below query example below and filter by the product you want to view:

dataset = metrics_source
| fields _vendor , _product , total_size_bytes , total_size_rate
| comp sum(total_size_bytes ) as ingestion by _product
| alter Ingestion_by_MB = divide(round(multiply(divide(ingestion , pow(2,20)),10000)),10000)
| fields _product ,Ingestion_by_MB
| sort desc Ingestion_by_MB

Regards.

If you feel this answered your inquiry please mark As Solution.

[PA_nts]

Thanks Mavega

..that does work.. but, it shows the metrics for xdrc - the xdr collector only. not xdr agents.

any ideas?

thanks

[A.Elzedy]

I'm not aware of any log size's metrics for endpoints, but being familiar with the log counts per xdr agent should bring you closer to your goal  

dataset = xdr_data 
| filter   _product = "XDR agent"
| comp count() as logs by agent_id , agent_hostname 
| sort desc logs

[kadirerol]

dataset = metrics_source

|comp sum (total_size_bytes) as gunluk_total_bytes by _product //

|alter gunluk_ortalama_log_boyut_kb=divide (gunluk_total_bytes ,1024) //KB
|alter gunluk_ortalama_log_boyut_mb=divide (gunluk_ortalama_log_boyut_kb ,1024) //MB
|alter gunluk_ortalama_log_boyut_gb=divide (gunluk_ortalama_log_boyut_mb ,1024) // GB


you can use this query

[kadirerol]

By the way How can we write an XQL query to calculate the total log volume for the last 24 hours in GB and check whether it is 20% higher than the previous day?