Skip to content

Commit 6f8ba14

Browse files
authored
Update search-across-child-orgs.md
1 parent 4afad80 commit 6f8ba14

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

docs/search/search-across-child-orgs.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ Follow the steps below to perform a child org-level search:
1414
1. Click the <img src={useBaseUrl('img/search/get-started-search/search-page/child-org-select-button.png')} alt="child-org-select-button" style={{border: '1px solid gray'}} width="30"/> button to select the child org where you want to query. You can either select one child org or multiple chid orgs.<br/><img src={useBaseUrl('img/search/get-started-search/search-page/child-org-dropdown.png')} alt="child-org-dropdown" style={{border: '1px solid gray'}} width="800"/>
1515
1. Enter the required query and click the search button to obtain the search results.
1616
:::note
17-
Make sure you use an aggregator and `_orgID` for multi-child org queries. For example, `* | count by _orgId`.
17+
Make sure you use an aggregator and `_orgID` for multi-child org queries. For example, `* | count by _orgId` or `* | count by _orgId | sum (_count)`.
1818
:::
1919

2020
There can be two possible errors while running the multi-child org queries:
2121

22-
- **Partial success**. This occurs when you run a query across all child organizations, and while some child organizations successfully execute, one or more encounter failures. Despite the failures, aggregate results from the successfully executed child organizations will be displayed. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
23-
- **Error**. This occurs when you run a query across all child organizations, and all child organizations encounter failures with no child organizations returning the successful result. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
22+
- **Partial success**. This occurs when you run a query across all child orgs, and while some child orgs successfully execute, one or more encounter failures. Despite the failures, aggregate results from the successfully executed child orgs will be displayed. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
23+
- **Error**. This occurs when you run a query across all child orgs, and all child orgs encounter failures with no child orgs returning the successful result. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
2424

2525
:::note
2626
- All the searches that run via the child org in the parent org would be billed under the child org account.
@@ -30,4 +30,4 @@ There can be two possible errors while running the multi-child org queries:
3030

3131
For more information about the Log Search, refer to [Search Basics](/docs/search/get-started-with-search/search-basics/).
3232

33-
To view your log data in a dashboard, refer to [Create a Dashboard for Child Orgs (MSSPs)](/docs/dashboards/dashboard-child-orgs).
33+
To view your log data in a dashboard, refer to [Create a Dashboard for Child Orgs (MSSPs)](/docs/dashboards/dashboard-child-orgs).

0 commit comments

Comments
 (0)