XQL Query for calculating XDR log ingestion

[PA_nts]

Hi, 
As this is covered by the XDR license and not visible in the data ingestion widgets..

Does anyone have a query to look at data ingestion for XDR agents only?

thanks in adv

[mavega]

Hi,

Thanks for reaching out LC.

You can use the below query example below and filter by the product you want to view:

dataset = metrics_source
| fields _vendor , _product , total_size_bytes , total_size_rate
| comp sum(total_size_bytes ) as ingestion by _product
| alter Ingestion_by_MB = divide(round(multiply(divide(ingestion , pow(2,20)),10000)),10000)
| fields _product ,Ingestion_by_MB
| sort desc Ingestion_by_MB

Regards.

If you feel this answered your inquiry please mark As Solution.

[PA_nts]

Thanks Mavega

..that does work.. but, it shows the metrics for xdrc - the xdr collector only. not xdr agents.

any ideas?

thanks

[A.Elzedy]

I'm not aware of any log size's metrics for endpoints, but being familiar with the log counts per xdr agent should bring you closer to your goal  

dataset = xdr_data 
| filter   _product = "XDR agent"
| comp count() as logs by agent_id , agent_hostname 
| sort desc logs