You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Searchable Time** refers to the additional processing time required to make logs available for searching after they are received by the Sumo Logic system. This processing includes enrichment, indexing, and storage, all of which contribute to the overall Searchable Time.
16
+
**Searchable Time** refers to the additional processing time required to make logs available for search after they are received by the Sumo Logic system. This processing includes enrichment, indexing, and storage, all of which contribute to the overall Searchable Time.
17
17
18
18
Previously, it was recommended to use receipt time instead of message time to avoid issues with missing duplicate data. However, this often led to inconsistent error messages due to variable ingestion latency and non-linear receipt time indexing. **Searchable Time** resolves this issue by marking the time only when the data is truly searchable. This provides a linear timeline, ensuring that running queries with non-overlapping but exhaustive time ranges will prevent any gaps or duplication in the data.
19
19
20
20
:::info
21
21
Currently, **Searchable Time** is only available for the Log Search UI page, Schedule Searches, Saved Searches, Dashboards, and Search Job API queries.
22
22
:::
23
23
24
-
## Run a search using Searchable Time
24
+
## Via UI
25
+
26
+
### Run a search using Searchable Time
25
27
26
28
Follow the below steps to run a search by Searchable Time:
27
29
@@ -30,14 +32,14 @@ Follow the below steps to run a search by Searchable Time:
30
32
1. Click the gear icon to open the **Search Config** menu and toggle **Searchable Time** on.<br/><img src={useBaseUrl('/img/search/get-started-search/build-search/searchable-time-option.png')} alt="searchable-time-option" style={{border:'1px solid gray'}} width="500" />
31
33
1. Review the search results for wide discrepancies between message time, receipt time, and searchable time.<br/><img src={useBaseUrl('/img/search/get-started-search/build-search/searchable-time-results-messages-tab.png')} alt="searchable-time-results-messages-tab" style={{border:'1px solid gray'}} width="800" />
32
34
33
-
## Run a scheduled search using Searchable Time
35
+
###Run a scheduled search using Searchable Time
34
36
35
37
Follow the below steps to run a scheduled search by Searchable Time:
36
38
37
39
1. Enter your query in the search text box and click **Save As..**.
38
40
1. In the **Save Item** pop-up, select **Searchable Time** from the timestamp dropdown.<br/><img src={useBaseUrl('/img/search/get-started-search/build-search/searchable-time-scheduled-search.png')} alt="searchable-time-scheduled-search" style={{border:'1px solid gray'}} width="500" />
39
41
40
-
## Run a search using Searchable Time in dashboard
42
+
###Run a search using Searchable Time in dashboard
41
43
42
44
:::note
43
45
**Searchbale Time** will not be available for *Metrics* or *Spans* query.
@@ -51,7 +53,9 @@ Follow the below steps to run a search using the Searchable Time in the dashboar
51
53
1. Navigate to **General** configuration.
52
54
1. Go to **Logs Settings** section and select **Searchbale Time** as the timestamp.<br/><img src={useBaseUrl('/img/search/get-started-search/build-search/searchable-time-dashboard.png')} alt="searchable-time-dashboard" style={{border:'1px solid gray'}} width="500" />
53
55
54
-
## Run/save a search by Searchable Time using API
56
+
## Via API
57
+
58
+
### Run a search by Searchable Time using Search Job API
55
59
56
60
To create a search, refer to the [Search Job API Documentation](/docs/api/search-job/#create-a-search-job). Below mentioned parameter has been updated due to addition of Searchable time feature:
57
61
@@ -63,7 +67,7 @@ To create a search, refer to the [Search Job API Documentation](/docs/api/search
63
67
If both `runByReceiptTime` and `intervalTimeType` parameters are present then the preference will be given to the `intervalTimeType`.
64
68
:::
65
69
66
-
##Run a dashboard by Searchable Time using API
70
+
### Create a dashboard with Searchable Time
67
71
68
72
To create a dashboard, refer to the [Search Job API Documentation](/docs/api/dashboard/). Below mentioned parameter has been updated due to addition of Searchable time feature:
0 commit comments