How Data Ingestion Affects Your License

Your product license specifies the maximum number of events per second that your system can ingest, based on the moving median events per second (MMEPS) value. To calculate MMEPS, the system performs the following actions:

  1. Calculate Events Per Day (EPD): Events Per Day is the total number of events ingested into database in a twenty-four hour period. For Day1, the system calculates the EPD based from the time you install the product until GTM+0 hours. The time frame is based on GTM+0 hours starting at 00:00:00 and ending at 23:59:59, regardless of any local times that might be in use.
  2. Calculate Sustained EPS (SEPS): Sustained EPS is the “constant” events per second that the system sustained within the 240hour period. For Day1, the system calculates the EPD based from the time you install the product until GTM+0 hours. It normalizes peaks and valleys to give a better indication of use. The formula used for this calculation is (EPD/((60*60)*24)).
  3. Calculate MMEPS for the last 45 days: Using the SEPS information recorded per day, the system calculates a moving median EPS value using the data set from the last 45-days. After the first 45 days, the system adjusts the calculation window one day every24 hours. The official clock for calculation purposes is defined by GTM+0 hours starting at 00:00:00 to 23:59:59 regardless of local time.

Your product license remains in compliance as long as the MMEPS value remains at the limit or below the purchased license capacity. If three or more consecutive MMEPS value indicators exceed their capacity based on the purchased license, the license is considered to be out of compliance. ArcSight Platform displays a warning until the data ingestion rate normalizes.