Estimate Scan Data

When you enter a query against Flex pricing, Sumo Logic will estimate and display the amount of data scanned in Flex to return the search results. This detail is vital. With Flex pricing, you're charged for the amount of data that's scanned to complete the query.

You can view this detail by clicking the meter icon . A popup appears that displays the estimated scan data for the chargeable tiers like Infrequent and Flex.

The example below shows the estimate of how much Flex data will be scanned for a query in the scope.

When you click on the session ID under the histogram, a popup with more detailed information appears. Here you can see the Flex data scanned for a query in the scope.

If there is no pay-per-search data scanned, a warning message will be displayed in the Scan Estimates popup.

Monitors

When creating or modifying a monitor, you can view the Average scan, Daily scan, and Yearly scan data information based on the selected alert frequency by clicking the meter icon on top of the Monitor right side panel.

In addition, you can also see the Model training scan details for the anomaly detection method.

note

You can view the scan estimates data once you select the trigger type.

Scheduled searches

As Sumo Logic charges for each data scan, scheduling searches can help mitigate costs. When creating or modifying a scheduled search, you can view the Average scan, Daily scan, and Yearly scanned data information based on the selected run frequency by clicking the meter icon on top of the Schedule this search popup.

note

Daily scan data will not be available if scheduled search runs only on selected days and not daily.

Best practices

• Use the _index field to reduce the scope of the query.