How long does it "typically" take for SumoLogic to ingest CloudTrail logs?


1 comment

  • Avatar
    Olaf Stein

    The other static variable at play is the scan frequency(1m or 5m) you set in your source config.
    If you scan every minute you could see data as quickly as 2 minutes after the data was written to the bucket, there is some time needed for indexing after data ingestion, this is typically no more then 30 seconds.

    One known issue with delays is the number of items in a bucket and the scan path. When we make an API call to get new data we first list all the items in the scan path, for buckets with large amounts of items, this can take a while, we have seen up to 2 hours. To workaround this issue we recommend periodically moving older data out of the scan path, so the list portion does not take long.

    Hope this helps




    Comment actions Permalink

Please sign in to leave a comment.