You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/alerts/monitors/alert-response-faq.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,6 +4,8 @@ title: Alert Response FAQ
4
4
description: Our commonly asked questions about alert response are documented for your reference.
5
5
---
6
6
7
+
import useBaseUrl from '@docusaurus/useBaseUrl';
8
+
7
9
## Is alert response available in all Sumo Logic packages?
8
10
9
11
Overall, yes. Alert response is available in all the Sumo Logic packages. However, there are specific features within alert response that only work on specific packages. See the table below for details.
@@ -41,7 +43,7 @@ For example, in Slack, you can add the following section to the **Alert Payload*
Copy file name to clipboardExpand all lines: docs/alerts/monitors/alert-response.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ Learn how to use alert response.
37
37
38
38
## Setting up alert response
39
39
40
-
Email alerts automatically get a button labeled **View Alert** that opens the alert on the alert page, shown in the below image.<br/>
40
+
Email alerts automatically get a button labeled **View Alert** that opens the alert on the alert page, shown in the below image.<br/><img src={useBaseUrl('img/alerts/monitors/view-alert-from-email.png')} alt="View alert from email" style={{border: '1px solid gray'}} width="800" />
41
41
42
42
If you use [Webhook connections](/docs/alerts/webhook-connections) offered by Sumo Logic for receiving notifications, you'll need to provide the [`alertResponseUrl` variable](/docs/alerts/monitors/alert-variables) in your notification payload of a monitor to receive a link that opens alert response. When your monitor is triggered, it will generate a URL and provide it in the alert notification payload, which you can use to open the alert response.
43
43
@@ -72,7 +72,7 @@ To get to your Alert List:
72
72
* From the [**New UI**](/docs/get-started/sumo-logic-ui/), select **Alerts**.
73
73
* From the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic), click the bell icon in the top menu.
74
74
75
-
To search alerts, use the search bar and filters.<br/>
75
+
To search alerts, use the search bar and filters.<br/><img src={useBaseUrl('img/alerts/monitors/search-alert-list.png')} alt="Search alert list" style={{border: '1px solid gray'}} width="800" />
76
76
77
77
To sort by category (for example, **Name**, **Severity**, **Status**), click on a column header.
78
78
@@ -115,7 +115,7 @@ To view detailed information about an alert, go to your [Alert List](#alert-list
115
115
* A history of previous occurrences of the alert.
116
116
* Key details such as the trigger time and the condition that caused the alert.
117
117
118
-
The following images and lists describe alert element on the page.<br/>
118
+
The following images and lists describe alert element on the page.<br/><img src={useBaseUrl('img/alerts/monitors/top-alert-response-page.png')} alt="Top of the alert response page" style={{border: '1px solid gray'}} width="800" />
119
119
120
120
***A**. Monitor name.
121
121
***B**. Copies the link to the opened alert page.
@@ -130,11 +130,11 @@ The following images and lists describe alert element on the page.<br/>to view the alert's trigger condition and the white arrow in the square  to open the alert in its own alert page.
137
+
***Entity**. Shows all the alerts that were triggered one hour before and after the given alert that happened on the same entity (node, pod, cluster, etc.). You can click the expand arrow <img src={useBaseUrl('img/alerts/monitors/expand-arrow.png')} alt="Expand arrow" width="30" /> to view the alert's trigger condition and the white arrow in the square <img src={useBaseUrl('img/alerts/monitors/open-new-tab.png')} alt="Open in new tab icon" width="30" /> to open the alert in its own alert page.
138
138
***Monitor History**. Shows the past 30 days of similar alerts that were triggered by the monitor (that generated the current alert). Monitor History can be helpful to determine how frequently an alert has fired in the past and if the alert is flaky. You can then quickly correlate whether the current problem is similar to a past one by comparing the information shared for the alert.
139
139
***L**. The query of the monitor.<br/><img src={useBaseUrl('img/alerts/monitors/l-m-n-labels.png')} alt="labels" width="800"/>
140
140
***M**. A chart that visualizes the trend of the metric that was tracked as part of the alert condition of the monitor. The visualization tracks the *before* and *during* trends of the metric.
@@ -191,7 +191,7 @@ The **Log Fluctuations** context card, available for logs monitors, detects diff
191
191
192
192
This card detects time series anomalies for entities related to the alert.
193
193
194
-
Anomalies are grouped into [golden signals](https://sre.google/sre-book/monitoring-distributed-systems/). Anomalies are also presented on a timeline; the length of the anomaly represents its duration. <br/>
194
+
Anomalies are grouped into [golden signals](https://sre.google/sre-book/monitoring-distributed-systems/). Anomalies are also presented on a timeline; the length of the anomaly represents its duration. <br/><img src={useBaseUrl('img/alerts/monitors/anomalies.png')} alt="Anomalies" style={{border: '1px solid gray'}} width="800" />
195
195
196
196
***A**. Name and description of the context card.
197
197
***B**. Count of anomalies belonging to each golden signal type.
@@ -202,15 +202,15 @@ Anomalies are grouped into [golden signals](https://sre.google/sre-book/monitor
202
202
Only anomalies with a start time around 30 minutes before or after the alert was created show up in the card.
203
203
:::
204
204
205
-
Hover over an EOI to view key information about the event.<br/>
205
+
Hover over an EOI to view key information about the event.<br/><img src={useBaseUrl('img/alerts/monitors/eoi-stats.png')} alt="EOI stats" style={{border: '1px solid gray'}} width="300" />
206
206
207
-
Click on the EOI to open the **Summary View** and **Entity Inspector**.<br/>
207
+
Click on the EOI to open the **Summary View** and **Entity Inspector**.<br/><img src={useBaseUrl('img/alerts/monitors/entity-inspector.png')} alt="Entity inspector" style={{border: '1px solid gray'}} width="400" />
208
208
209
209
### Benchmark
210
210
211
211
Benchmarks refer to baselines computed from anonymized and aggregated telemetry data from Sumo Logic customers in domains such as AWS. If the telemetry values for your entity during an alert period are unusual compared to benchmarks, you may have an unusual configuration change or other backend issues.
212
212
213
-
For example, the card below shows that `ServiceUnavailable` error is happening 32 times more often in your AWS account compared with other Sumo Logic customer’s accounts. This AWS error pertains to AWS API calls that are failing at a higher rate than what is expected based on cross-customer baselines. This particular error implies an AWS incident affecting the particular AWS resource type and API. <br/>
213
+
For example, the card below shows that `ServiceUnavailable` error is happening 32 times more often in your AWS account compared with other Sumo Logic customer’s accounts. This AWS error pertains to AWS API calls that are failing at a higher rate than what is expected based on cross-customer baselines. This particular error implies an AWS incident affecting the particular AWS resource type and API. <br/><img src={useBaseUrl('img/alerts/monitors/benchmark.png')} alt="Benchmark card" style={{border: '1px solid gray'}} width="800" />
214
214
215
215
***A**. Name and description of the context card.
216
216
***B**. Count of unusual Benchmarks by golden signal type.
Copy file name to clipboardExpand all lines: docs/alerts/monitors/create-monitor.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -318,7 +318,7 @@ For example, when an alert is set to `greater than 10`, the recovery would be
318
318
|`<threshold type>`| How you want the value compared. Select greater than, greater than or equal, less than or equal, or less than. |
319
319
|`<threshold>`| The value against which the resolution will be evaluated. You can specify any valid numeric value. |
320
320
321
-
The Alert and recovery setting affects both the alert generation logic and the alert recovery logic. `Alert and recovery require a minimum of <count> data points for "at all times" evaluation windows`. This setting only works when you choose `at all times within` as the type of occurrence for the alert. <br/>
321
+
The Alert and recovery setting affects both the alert generation logic and the alert recovery logic. `Alert and recovery require a minimum of <count> data points for "at all times" evaluation windows`. This setting only works when you choose `at all times within` as the type of occurrence for the alert. <br/><img src={useBaseUrl('img/alerts/monitors/minimum-datapoints.png')} alt="Metrics alert datapoints" style={{border: '1px solid gray'}} width="800" />
Copy file name to clipboardExpand all lines: docs/alerts/monitors/monitor-faq.md
+3-2Lines changed: 3 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,6 +4,7 @@ title: Monitors FAQ
4
4
description: Frequently asked questions about Sumo Logic monitors.
5
5
---
6
6
7
+
import useBaseUrl from '@docusaurus/useBaseUrl';
7
8
import AlertsTimeslice from '../../reuse/alerts-timeslice.md';
8
9
9
10
## How can I optimize scan costs for monitors when using Flex Pricing?
@@ -85,9 +86,9 @@ The [Test Connection feature for webhooks](/docs/alerts/webhook-connections/se
85
86
86
87
## One of our monitors suddenly stopped sending notifications, even though I see it on the monitors page
87
88
88
-
One reason could be that the user who created the monitor was deleted. You can check the **Created By** value on the monitors page. If it has `<User Unknown>`, you will need to re-create the monitor. <br/>
89
+
One reason could be that the user who created the monitor was deleted. You can check the **Created By** value on the monitors page. If it has `<User Unknown>`, you will need to re-create the monitor. <br/><img src={useBaseUrl('img/alerts/monitors/user-unknown-monitors.png')} alt="User unknown monitors" style={{border: '1px solid gray'}} width="200" />
89
90
90
-
You can quickly **Duplicate** the monitor by hovering over it on the monitors page and clicking the three-dot kebab icon:<br/>
91
+
You can quickly **Duplicate** the monitor by hovering over it on the monitors page and clicking the three-dot kebab icon:<br/><img src={useBaseUrl('img/alerts/monitors/more-actions-menu-for-monitors.png')} alt="More actions menu for monitors" style={{border: '1px solid gray'}} width="300" />
91
92
92
93
then selecting **Duplicate**. If your monitor still doesn't work, we recommend contacting [Sumo Logic support](https://support.sumologic.com/).
Copy file name to clipboardExpand all lines: docs/alerts/scheduled-searches/create-email-alert.md
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -74,8 +74,6 @@ Do either of the following:
74
74
* To make changes to the search query before you run it again, click the saved search title link, next to **Saved Search**. This will open the query in the Sumo Logic search page.
75
75
* To see all the results of the search, under **Message Distribution**, click the **View results in Sumo Logic** link in the email. Or under **Aggregation**, click "**here**". Sumo Logic will recreate the search exactly matching the query and time parameters of the original scheduled search.
76
76
77
-

78
-
79
77
:::note
80
78
If you're a new user and someone has forwarded you an alert email, the links to the search will not work until you've completed your setup process.
81
79
:::
@@ -104,7 +102,7 @@ The Scheduled Search Email Alert template includes the following details:
104
102
***Aggregation.** Displays the first 25 messages of the search results, and includes the complete number of results. Click "**here**" in the email to view the full results in Sumo Logic.
105
103
***Results as CSV attachment.** If you have selected to receive your scheduled search results as a CSV file, it will be attached to the email. The maximum CSV file size allowed is 5MB or 1,000 results.
106
104
107
-

Rarely, there may be circumstances that prevent the histogram from loading fast enough to be included with the email before it is sent. In that case, you will receive an email with all pertinent information, just without the graph.
Copy file name to clipboardExpand all lines: docs/alerts/scheduled-searches/edit-cancel.md
+5-3Lines changed: 5 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,8 @@ sidebar_label: Edit or Cancel a Scheduled Search
5
5
description: You can edit or cancel a Scheduled Search at any time.
6
6
---
7
7
8
+
import useBaseUrl from '@docusaurus/useBaseUrl';
9
+
8
10
You can edit or cancel a Scheduled Search at any time from your [Library](/docs/get-started/library). If you cancel a scheduled search, it will revert to a saved search.
9
11
10
12
:::important
@@ -14,8 +16,8 @@ If the user who "owns" a Scheduled Search is removed from your org, the Schedule
14
16
## Cancel a Scheduled Search
15
17
16
18
1. Go to your **Library** and find the scheduled search you want to cancel. For information about finding an item in the Library, see [Search the Library](/docs/get-started/library#search-the-library).
17
-
1. Click the more options menu to the right of the scheduled search and select **Edit**. <br/>
18
-
1. In the **Edit Search** dialog, click **Edit this search's schedule**.<br/>
19
+
1. Click the more options menu to the right of the scheduled search and select **Edit**. <br/><img src={useBaseUrl('img/alerts/list-of-sched-searches.png')} alt="Library scheduled search edit" style={{border: '1px solid gray'}} width="800" />
20
+
1. In the **Edit Search** dialog, click **Edit this search's schedule**.<br/><img src={useBaseUrl('img/alerts/edit-search.png')} alt="Edit search" style={{border: '1px solid gray'}} width="500" />
19
21
1. From the **Run Frequency** menu, choose **Never** to cancel the scheduled search.
20
22
1. Click **Update**.
21
23
@@ -48,4 +50,4 @@ You have two options to resolve the issue:
48
50
If you don’t have the **Change Data Access Level** capability, your Sumo Logic administrator will need to update your role to include it.
The [Audit Index](/docs/manage/security/audit-indexes/audit-index) stores events on your scheduled search events. The following is an example of a temporary suspension log:
The [Audit Index](/docs/manage/security/audit-indexes/audit-index) stores events on your scheduled search events. The following is an example of a permanent suspension log:
Copy file name to clipboardExpand all lines: docs/alerts/scheduled-searches/save-to-index.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,8 @@ sidebar_label: Save to Index
5
5
description: When you save the results of a scheduled search to an Index you can search your data using _index=index_name with increased search performance.
6
6
---
7
7
8
+
import useBaseUrl from '@docusaurus/useBaseUrl';
9
+
8
10
When you create a Scheduled Search, you can save the results to an Index. This way, your data can be searched at a later time using `_index=index_name` with increased search performance.
9
11
10
12
For example, you could use the following query to find successful logins on a Linux system, then save the results to an Index using the **Save to Index** alert type for your Scheduled Search.
@@ -35,7 +37,7 @@ In most cases, if you can use a [Scheduled View](/docs/manage/scheduled-views)
35
37
## Save the results of a scheduled search as an Index
36
38
37
39
1.[Save a search](/docs/search/get-started-with-search/search-basics/save-search).
38
-
1. Click **Schedule this search**.<br/>
40
+
1. Click **Schedule this search**.<br/><img src={useBaseUrl('img/alerts/SaveToIndex.png')} alt="Save to index" style={{border: '1px solid gray'}} width="500" />
39
41
1. For all configuration options, see [Schedule a Search](schedule-search.md).
40
42
1.**Alert Type**. Select **Save to Index**.
41
43
1.**Index Name**. Enter a name that you'll use to search the data in a query. Use a name that's descriptive and easy to remember. Names can be comprised of alphanumeric characters; underscores (`_`) are the only special characters allowed.
0 commit comments