You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/search/get-started-with-search/build-search/use-searchable-time.md
+44-2Lines changed: 44 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Previously, it was recommended to use receipt time instead of message time to av
21
21
Currently, **Searchable Time** is only available for the Log Search UI page, Schedule Searches, Saved Searches, Dashboards, and Search Job API queries.
22
22
:::
23
23
24
-
## Run a search by Searchable Time
24
+
## Run a search using Searchable Time
25
25
26
26
Follow the below steps to run a search by Searchable Time:
27
27
@@ -30,7 +30,49 @@ Follow the below steps to run a search by Searchable Time:
30
30
1. Click the gear icon to open the **Search Config** menu and toggle **Searchable Time** on.<br/><img src={useBaseUrl('/img/search/get-started-search/build-search/searchable-time-option.png')} alt="searchable-time-option" style={{border:'1px solid gray'}} width="500" />
31
31
1. Review the search results for wide discrepancies between message time, receipt time, and searchable time.<br/><img src={useBaseUrl('/img/search/get-started-search/build-search/searchable-time-results-messages-tab.png')} alt="searchable-time-results-messages-tab" style={{border:'1px solid gray'}} width="800" />
32
32
33
+
## Run a scheduled search using Searchable Time
34
+
35
+
Follow the below steps to run a scheduled search by Searchable Time:
36
+
37
+
1. Enter your query in the search text box and click **Save As..**.
38
+
1. In the **Save Item** pop-up, select **Searchable Time** from the timestamp dropdown.
39
+
40
+
## Run a search using Searchable Time in dashboard
41
+
42
+
::note
43
+
**Searchbale Time** will not be available for *Metrics* or *Spans* query.
44
+
:::
45
+
46
+
Follow the below steps to run a search using the Searchable Time in the dashboard:
47
+
48
+
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Go to the **Home** screen and select **Dashboard**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Dashboards > New Dashboard**. You can also click the **Go To...** menu at the top of the screen and select **New Dashboard**.
49
+
1. Select a panel type by clicking the corresponding icon.<br/><img src={useBaseUrl('/img/dashboards/create-dashboard/panel-types.png')} alt="panel types" style={{border: '1px solid gray'}} width="600" />
50
+
1. You are prompted to provide a log query.
51
+
1. Navigate to **General** configuration.
52
+
1. Go to **Logs Settings** section and select **Searchbale Time** as the timestamp.
53
+
54
+
## Run/save a search by Searchable Time using API
55
+
56
+
To create a search, refer to the [Search Job API Documentation](/docs/api/search-job/#create-a-search-job). Below mentioned parameter has been updated due to addition of Searchable time feature:
57
+
58
+
| Parameter | Type | Requried | Description |
59
+
|`intervalTimeType`| String | Yes | This parameter defines whether you want to run the search by messageTime, receiptTime, or searchableTime. By default, the search will run by messageTime. |
60
+
61
+
:::note
62
+
If both `runByReceiptTime` and `intervalTimeType` parameters are present then the preference will be given to the `intervalTimeType`.
63
+
:::
64
+
65
+
## Run a dashboard by Searchable Time using API
66
+
67
+
To create a dashboard, refer to the [Search Job API Documentation](/docs/api/dashboard/). Below mentioned parameter has been updated due to addition of Searchable time feature:
68
+
69
+
| Parameter | Type | Requried | Description |
70
+
|`timeSource`| String | Yes | This parameter defines the time source of the query. Possible values are `Message`, `Receipt`, or `Searchable`. By default, `Message` will be used as the time source. </br>**Message**. Uses the timestamp on the message.</br>**Receipt**. Timestamp when the logs were received by Sumo Logic.</br>**Searchable**. Timestamp when the logs are available for search. |
71
+
72
+
:::info
73
+
`time_source` field in the *terraform* supports **Searchable** value for dashboards.
74
+
:::
75
+
33
76
## Limitations
34
77
35
78
- Subqueries are not supported for Searchable Time.
36
-
-`time_source` field in the terraform supports **Searchable** value for dashboards.
0 commit comments