Estimate Scan Data

When you enter a query against Flex pricing, Sumo Logic will estimate and display the amount of data scanned in Flex to return the search results. This detail is vital. With Flex pricing, you're charged for the amount of data that's scanned to complete the query.

You can view this detail by clicking the meter icon . A popup appears that displays the estimated scan data for the chargeable tiers like Infrequent and Flex.

The example below shows the estimate of how much Flex data will be scanned for a query in the scope.

When you click on the session ID under the histogram, a popup with more detailed information appears. Here you can see the Flex data scanned for a query in the scope.

If there is no pay-per-search data scanned, a warning message will be displayed in the Scan Estimates popup.

Monitors

When creating or modifying a monitor, you can view the Average scan, Daily scan, and Yearly scan data information based on the selected alert frequency by clicking the meter icon on top of the Monitor right side panel.

In addition, you can also see the Model training scan details for the anomaly detection method.

note

You can view the scan estimates data once you select the trigger type.

Scheduled searches

As Sumo Logic charges for each data scan, scheduling searches can help mitigate costs. When creating or modifying a scheduled search, you can view the Average scan, Daily scan, and Yearly scanned data information based on the selected run frequency by clicking the meter icon on top of the Schedule this search popup.

note

Daily scan data will not be available if scheduled search runs only on selected days and not daily.

Scan estimates in SLO

To view the Daily scan and Yearly scan data information based on a log-based SLO:

1. Go to the Monitoring and click the SLO tab.
2. Hover over your SLO, click the three-dot kebab menu, and then click Edit.
3. Click the meter icon in the upper right corner.

• For Request-based SLOs, data is scanned once per minute and stored in SLO storage. Any late-arriving data is accounted for in a corrective fashion and appended to the SLO storage.
• For Window-based SLOs, data is scanned multiple times per minute. Due to technical reasons, late-arriving data cannot be accounted for, unlike request-based SLOs. Because of this, the SLO results are stored in SLO storage with some delay (typically 1 hour). To display up-to-date SLI values across our various SLO dashboards, we need to scan the last 1 hour of data multiple times.

Dashboard scan estimates

When you enter a query to create a dashboard panel, Sumo Logic will estimate and display the amount of data scanned in Flex. This detail is crucial because, with Flex Pricing you are charged for the amount of data that is scanned to complete the query.

You can view the scan detail by clicking the meter icon . A popup appears that displays the estimated scan data for the chargeable Flex model.

You can also view the actual amount of data scanned after a dashboard panel has completed loading, helping you to mitigate costs.

To view the scan estimates for the dashboard panel you have created:

1. Go to the panel for which you want to see the scan details.
2. Click the three-dot kebab menu, and then select Info.
3. You can see the scan data details against Scanned Bytes - Flex.

Best practices

• Use the _index field to reduce the scope of the query.