IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

EDR: How to Find the Average Number of Events from Solr

EDR: How to Find the Average Number of Events from Solr

Environment

  • EDR Server: All Versions

Objective

To find the average number of events ingested from the Solr console

Resolution

  1. Open the Solr console.
  2. Navigate to Core Admin and find the name of a recent core that was rolled over.
  3. Select the core at the bottom left and check number of docs and total index size on the Core Overview page. This will provide the average doc size.
  4. Run the query: 
    http://localhost:8080/solr/<SolrCoreName>/select?q=terminated%3Atrue&wt=json&indent=true&rows=0&json.facet={modload_count:%22avg(modload_count)%22,regmod_count:%22avg(regmod_count)%22,filemod_count:%22avg(filemod_count)%22,netconn_count:%22avg(netconn_count)%22,childproc_count:%22avg(childproc_count)%22,crossproc_count:%22avg(crossproc_count)%22}
  5. Review the data values to determine the averages.

Additional Notes

  • Replace <SolrCoreName> with the specific core name that data is being collected from
  • Take note of a core's rollover period. It is usually 3 days in length, but it could be different depending on the configuration. 

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
360
Contributors