POC from SIEM (submit)

Previous value: -"Default true: use MCP sampling to ask the host LLM (the same model the user is already chatting with — Claude Desktop, Claude Code, Cursor, etc.) to batch-generate 3-5-word human-readable names for the top patterns. No Log10x-side endpoint, no extra API key — the host uses whatever model + credentials the user already has. Sends only templated pattern identities (no variable values, no raw log content). Skipped automatically when the host does not advertise the `sampling` capability; the report falls back to raw snake_case identities plus a note. Set false to skip unconditionally."New value: +"Default true: use MCP sampling to ask the host LLM (the same model the user is already chatting with: Claude Desktop, Claude Code, Cursor, etc.) to batch-generate 3-5-word human-readable names for the top patterns. No Log10x-side endpoint, no extra API key: the host uses whatever model + credentials the user already has. Sends only templated pattern identities (no variable values, no raw log content). Skipped automatically when the host does not advertise the `sampling` capability; the report falls back to raw snake_case identities plus a note. Set false to skip unconditionally."

Previous value: -"[ClickHouse] Required — table name holding log events."New value: +"[ClickHouse] Required: table name holding log events."

Previous value: -"Optional environment nickname — cosmetic only, for the report header."New value: +"Optional environment nickname: cosmetic only, for the report header."

Previous value: -"Advanced — most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a service. Applied AFTER pin_services. Use only when a single pattern inside an otherwise-reducible service must be excepted (e.g., audit-trail log line inside a chatty service)."New value: +"Advanced: most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a service. Applied AFTER pin_services. Use only when a single pattern inside an otherwise-reducible service must be excepted (e.g., audit-trail log line inside a chatty service)."

Added value: +{
+  "description": "Bytes of forwarder metadata per record. The Receiver counts each record as the forwarder sends it, metadata included, and events read back from a SIEM's API seldom carry that record, so the caps add this to every event. Default 760, the median of a Fluent Bit kubernetes record on an EKS capture.",
+  "maximum": 100000,
+  "minimum": 0,
+  "type": "integer"
+}

Previous value: -"Target event count for the pull. Default 1,000,000 (~500 MB at 500B avg, tokenizes in 5-10 min). The pull self-terminates earlier on saturation — when new patterns per 100k events drops below 2%, the long tail has been covered and the report is generated. This default is intentionally two orders of magnitude beyond what an unaided agent can fit in context."New value: +"Target event count for the pull. Default 1,000,000 (~500 MB at 500B avg, tokenizes in 5-10 min). The pull self-terminates earlier on saturation: when new patterns per 100k events drops below 2%, the long tail has been covered and the report is generated. This default is intentionally two orders of magnitude beyond what an unaided agent can fit in context."

Previous value: -"Customer's total daily log volume in GB/day. Pick any one of total_daily_gb / total_monthly_gb / total_annual_gb — whichever unit the user naturally thinks in. The tool normalizes to daily internally. When any is provided (or auto_detect_volume succeeds), per-pattern costs are extrapolated from the pulled sample to the full volume, producing meaningful annual-savings figures instead of sub-cent numbers. Priority: daily > monthly > annual. If the pull was narrowed via `query` to one service, this overstates cost — only a fraction of daily volume matches the filter."New value: +"Customer's total daily log volume in GB/day. Pick any one of total_daily_gb / total_monthly_gb / total_annual_gb: whichever unit the user naturally thinks in. The tool normalizes to daily internally. When any is provided (or auto_detect_volume succeeds), per-pattern costs are extrapolated from the pulled sample to the full volume, producing meaningful annual-savings figures instead of sub-cent numbers. Priority: daily > monthly > annual. If the pull was narrowed via `query` to one service, this overstates cost: only a fraction of daily volume matches the filter."

Previous value: -"Window to pull over. Accepts \"1h\", \"24h\", \"7d\", \"14d\", \"30d\". Default \"14d\" — wide windows unlock the differentiated longitudinal signals (first-seen, growth, stable-vs-new) that the agent cannot compute from a small sample. Pull pacing is automatic; long windows take minutes but the snapshot continues in the background."New value: +"Window to pull over. Accepts \"1h\", \"24h\", \"7d\", \"14d\", \"30d\". Default \"14d\": wide windows unlock the differentiated longitudinal signals (first-seen, growth, stable-vs-new) that the agent cannot compute from a small sample. Pull pacing is automatic; long windows take minutes but the snapshot continues in the background."