Query budgets
Every time Huntbase searches one of your stores on a schedule, it runs a query there. Some stores limit or bill those queries. A query budget caps how many scheduled queries Huntbase runs on one connection in an hour.
The budget is set per connection, in queries per hour. Watcher deployments and your other scheduled queries on that connection share it. Queries you run yourself in Explorer don't count.
See how much is used
Open the connection's page. Under its stats, a line reads Queries this hour: N of M, followed by how many ran in the last day, product default when the connection uses its product's default, and how many watcher deployments are paused for budget. Hover for a note on how that store counts its cost.
- When the count can't be read, it says not known. It is never shown as 0.
- When the budget is 0, the line reads Scheduled queries are off for this connection.
- A connection with no limit shows no line.
When the budget runs out
- A watcher deployment that can't run this hour shows Paused: budget. It starts again by itself when the hour has room. You don't need to do anything.
- A plain scheduled query skips that connection for the run, and the run says so.
- While deployments are paused, they go first when room frees up, then the one that has waited longest. Under a small budget, rules take turns.
No events are skipped. Each deployment remembers how far through the store's events it has searched. Its next run starts from there, with a small overlap for late events, so a pause delays detections but doesn't lose them. After a long outage, one run covers at most 24 hours; anything older is noted on the deployment.
Defaults
When a connection sets no budget of its own, it uses its product's default:
| Product | Queries per hour | Shortest gap between runs |
|---|---|---|
| Axiom | 6 | 1 hour |
| Splunk | 60 | 5 minutes |
| Microsoft Sentinel | 60 | 5 minutes |
| Azure Log Analytics | 60 | 5 minutes |
| Microsoft Defender for Endpoint | 30 | 15 minutes |
| Elasticsearch | 120 | 1 minute |
A product with no default has no limit.
Change a budget
Changing a connection's budget isn't in the app yet. An administrator with permission to update the connection can set it through the Huntbase API, as a number of queries per hour from 0 to 10,000. Clearing it goes back to the product default. Set it to 0 to stop all scheduled queries on that connection.
Cost is shown for information only. Huntbase limits queries, not spend.