Hi,
I’m trying to build a Native Dashboard that would show the log_count and log_volume for GCP Projects but owned by different business units in the org.
Also, all ingestion into SecOps is via Direct Ingest
Using the below query, the namespace returns null value - which tells me the namespace must be set somewhere pre-processing:
ingestion.component = "Ingestion API"
$Namespace = ingestion.namespace
match:
$Namespace
outcome:
$Total_GB = math.round(sum(ingestion.log_volume) / math.pow(1000, 3), 2)
Please, any ideas on how to set the namespaces or perhaps other methods that would extract the project names or IDs pre-processing and can be used in a dashboard.
All suggestions would be greatly appreciated.
