Forum Discussion
Determine events per second for a potential Sentinel deployment
I have been tasked to determine the estimate of EPS (events per second) for 4 subscriptions. Need to get an idea of the cost of creating an Event Hub to send data to the SIEM. Any assistance/guidan...
If you have the data in a workspace already, you can query that for EPS, you may need to add a filter, something like this (not all tables store SubscriptionId though!)
| where SubscriptionId == "< sub id>"
union withsource=_TableName1 *
| where _TimeReceived > ago(1d)
| summarize count() by bin(_TimeReceived, 1m), Type
| extend counttemp =count_ / 60
| summarize
['Average Events per Second (eps)'] = avg(counttemp), ['Minimum eps']=min (counttemp),
['Maximum eps']=max(counttemp)
Hey Clive,
Ok, I think I figured it out. the _TableName1 is a way to run through all tables without naming a specific table which allows you to search all Tables available.
also, after reviewing the TimeReceived information in this table:
https://docs.microsoft.com/en-us/azure/azure-monitor/logs/data-ingestion-time#checking-ingestion-time
I was able to substitute as needed. I think I got the needed information. Thank you again.