You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/search/search-across-child-orgs.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,13 +14,13 @@ Follow the steps below to perform a child org-level search:
14
14
1. Click the <img src={useBaseUrl('img/search/get-started-search/search-page/child-org-select-button.png')} alt="child-org-select-button" style={{border: '1px solid gray'}} width="30"/> button to select the child org where you want to query. You can either select one child org or multiple chid orgs.<br/><img src={useBaseUrl('img/search/get-started-search/search-page/child-org-dropdown.png')} alt="child-org-dropdown" style={{border: '1px solid gray'}} width="800"/>
15
15
1. Enter the required query and click the search button to obtain the search results.
16
16
:::note
17
-
Make sure you use an aggregator and `_orgID` for multi-child org queries. For example, `* | count by _orgId`.
17
+
Make sure you use an aggregator and `_orgID` for multi-child org queries. For example, `* | count by _orgId` or `* | count by _orgId | sum (_count)`.
18
18
:::
19
19
20
20
There can be two possible errors while running the multi-child org queries:
21
21
22
-
-**Partial success**. This occurs when you run a query across all child organizations, and while some child organizations successfully execute, one or more encounter failures. Despite the failures, aggregate results from the successfully executed child organizations will be displayed. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
23
-
-**Error**. This occurs when you run a query across all child organizations, and all child organizations encounter failures with no child organizations returning the successful result. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
22
+
-**Partial success**. This occurs when you run a query across all child orgs, and while some child orgs successfully execute, one or more encounter failures. Despite the failures, aggregate results from the successfully executed child orgs will be displayed. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
23
+
-**Error**. This occurs when you run a query across all child orgs, and all child orgs encounter failures with no child orgs returning the successful result. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
24
24
25
25
:::note
26
26
- All the searches that run via the child org in the parent org would be billed under the child org account.
@@ -30,4 +30,4 @@ There can be two possible errors while running the multi-child org queries:
30
30
31
31
For more information about the Log Search, refer to [Search Basics](/docs/search/get-started-with-search/search-basics/).
32
32
33
-
To view your log data in a dashboard, refer to [Create a Dashboard for Child Orgs (MSSPs)](/docs/dashboards/dashboard-child-orgs).
33
+
To view your log data in a dashboard, refer to [Create a Dashboard for Child Orgs (MSSPs)](/docs/dashboards/dashboard-child-orgs).
0 commit comments