Hi all. The results of some of the queries you've provided (thanks for these!) provides a datapoint of upload_size. With a description of 'upload size of the query' - I assume the returned value is in bytes.
I also assume that this value is representative of the data that was uploaded from the endpoint into the datalake during a hydration query?
Sample ARP_Cache output from my own slice of the data_lake!
+-----------------+--------------+-----------------+-------------------+----------------------------------------+-----------------+---------------+ | meta_hostname | query_name | address | interface | meta_os_name | meta_username | upload_size | |-----------------+--------------+-----------------+-------------------+----------------------------------------+-----------------+---------------| | MediaNUC | arp_cache | 192.168.1.242 | b8:ae:ed:76:e2:98 | Microsoft Windows 10 Pro N | MediaNUC | 707 | | MediaNUC | arp_cache | 192.168.1.98 | b8:ae:ed:76:e2:98 | Microsoft Windows 10 Pro N | MediaNUC | 707 | | GNS3-DC01 | arp_cache | 239.255.255.250 | 08:00:27:90:02:d8 | Microsoft Windows Server 2016 Standard | | 699 |
