2021-05-04 07:31 AM - edited 2021-05-04 07:41 AM
I really need to understand the quantification of the events in the navigate view.
In particular the difference between the quantification by event size ordered by value or by total.
I mean: if the time filter in on "Yesterday" the Quantification ordered by Value sorted in Descending order quantified by Event Size
i can view the heaviest event recived while if I order by Total i can have the amount of byte that a particular event spent on the licence usage ?
Could anyone help me?
Thank you
2021-05-04 07:05 PM
If I'm understanding your question correctly, then you have it mostly correct.
The "Order by Total" option in combination with "Quantify by Event Size" will display the total Bytes ingested for your selected time period...but the platform will stop its actual count when it gets to 100,000 sessions, and will only estimate the additional/higher counts based on the percentage of events/sessions of that 100,000::Total events.
For example, in my Last 24 Hours time period, lets say I have ~1,000,000,000 total sessions - the platform will stop counting when it finds 100,000 values matching my query and estimate that, since there are roughly 1,000,000,000 sessions in my time period, that 100,000 represents 1% of the actual total, and the UI will display (>100,000 session - 1%) ==> "we found 100,000 sessions matching your query and stopped counting, and we estimate that 100,000 is 1% of the actual total number of sessions matching your query".
The "Decoder Source" a.k.a did, metakey will display the most accurate results, as the platform will not stop counting that metakey when it hits the 100,000 session limit.
As for the "Order by Value" option, that will display the result values in alphabetical or numerical order, not based on the number of values found.
2021-05-04 07:05 PM
If I'm understanding your question correctly, then you have it mostly correct.
The "Order by Total" option in combination with "Quantify by Event Size" will display the total Bytes ingested for your selected time period...but the platform will stop its actual count when it gets to 100,000 sessions, and will only estimate the additional/higher counts based on the percentage of events/sessions of that 100,000::Total events.
For example, in my Last 24 Hours time period, lets say I have ~1,000,000,000 total sessions - the platform will stop counting when it finds 100,000 values matching my query and estimate that, since there are roughly 1,000,000,000 sessions in my time period, that 100,000 represents 1% of the actual total, and the UI will display (>100,000 session - 1%) ==> "we found 100,000 sessions matching your query and stopped counting, and we estimate that 100,000 is 1% of the actual total number of sessions matching your query".
The "Decoder Source" a.k.a did, metakey will display the most accurate results, as the platform will not stop counting that metakey when it hits the 100,000 session limit.
As for the "Order by Value" option, that will display the result values in alphabetical or numerical order, not based on the number of values found.
2021-05-05 07:52 AM
Thank you Josh!