You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/search/mobot.md
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,7 +32,7 @@ Together, these agents help you troubleshoot faster, explore your data more intu
32
32
### Key capabilities
33
33
34
34
***Auto-visualization**. Generate charts automatically from search results and add them directly to dashboards.
35
-
***Broad log compatibility**. Works with structured, semi-structured, and unstructured logs (like Palo Alto Firewall) when Field Extraction Rules are applied.
35
+
***Broad log compatibility**. Works with structured and semi-structured logs. To analyze unstructured logs (like Palo Alto Firewall), you'll need to apply Field Extraction Rules.
36
36
***Automatic source detection**. Let Mobot choose a data source based on your question, or specify one yourself.
37
37
***Clarifications when needed**. If your request is ambiguous, Mobot asks follow-up questions to narrow intent.
38
38
***Smarter error handling**. Get clear messages and actionable suggestions instead of generic errors.
@@ -92,7 +92,7 @@ To open Mobot, click **Mobot** in the left nav.
92
92
93
93
:::sumo Micro Lesson
94
94
95
-
In this video, you'll learn how to use Mobot helps you write log search queries.
95
+
In this video, you'll learn how to turn natural language requests into queries, simplifying data exploration.
@@ -211,14 +211,14 @@ The following rules are used to deduce chart type:
211
211
212
212
#### Edit query code
213
213
214
-
You can manually edit your log search query code if needed.
214
+
Optionally, you can manually edit your log search query code.
215
215
216
-
1. Click in the code editor field and edit your search.<br/><img src={useBaseUrl('img/search/mobot/code-editor.png')} alt="Mobot time period" style={{border: '1px solid gray'}} width="500" />
217
-
:::tip
218
-
New to Sumo Logic query language? [Learn more](/docs/search/search-query-language).
219
-
:::
220
-
1.When you're done, press Enter or click the search button.
221
-
1.(Optional) To save space, you can use the **Hide Log Query** icon to collapse the log query code.<br/><img src={useBaseUrl('img/search/mobot/show-hide-query.png')} alt="Mobot time period" style={{border: '1px solid gray'}} width="500" />
216
+
:::tip
217
+
New to Sumo Logic query language? [Learn more](/docs/search/search-query-language).
218
+
:::
219
+
220
+
1.Click in the code editor field and edit your query.<br/><img src={useBaseUrl('img/search/mobot/code-editor.png')} alt="Mobot time period" style={{border: '1px solid gray'}} width="500" />
221
+
1.Click the search button.
222
222
223
223
#### Open in Log Search
224
224
@@ -229,15 +229,15 @@ There are two ways to do this:
229
229
* From your conversation, click **View results**.<br/><img src={useBaseUrl('img/search/mobot/open-in-log-search-view-results.png')} alt="Mobot option to open your query in Log Search" style={{border: '1px solid gray'}} width="700" />
230
230
* From the query section, click the **Open in Log Search** icon.<br/><img src={useBaseUrl('img/search/mobot/open-in-log-search.png')} alt="Open in Log Search button in Mobot" style={{border: '1px solid gray'}} width="500" />
231
231
232
-
#### Edit conversation title
232
+
#### My Conversations
233
233
234
-
Query Agent automatically updates conversation titles based on your query. You can also set a custom title by clicking the "Edit Title" (pencil) icon. This helps keep investigations organized and easier to revisit.
234
+
To resume a conversation, go to the **My Conversations** list and click on the one you're looking for.
235
235
236
-
#### My Conversations
236
+
This conversation history feature saves all previous queries and suggestions, allowing you to backtrack and refine your investigation. For example, if a status code analysis yields inconclusive results, you can revisit earlier queries to explore other possibilities. This functionality can also be useful when you're working on multiple incidents at the same time.
237
237
238
-
The conversation history feature saves all previous queries and suggestions, allowing you to backtrack and refine your investigation. For example, if a status code analysis yields inconclusive results, you can revisit earlier queries to explore other possibilities. This functionality can also be useful when you're working on multiple incidents at the same time.
238
+
#### Edit conversation title
239
239
240
-
To resume a conversation, go to the **My Conversations**list and click on the one you're looking for.
240
+
Query Agent automatically updates conversation titles based on your query. You can also set a custom title by hovering over your conversation in the **My Conversations**pane, then clicking the "Rename" pencil icon. This helps keep investigations organized and easier to revisit.
241
241
242
242
#### New Conversation
243
243
@@ -250,8 +250,8 @@ To start a fresh exploration, click **New Conversation**. This clears your curre
250
250
251
251
Get the most out of Query Agent by following these tips:
252
252
253
-
***Talk to it like a conversation**. Layer refinements instead of rewriting the whole question. For example, start with "Show me API errors" then follow up with "group by status code" and "show the last 6 hours."
254
-
***Be specific**. Combine filters, units, and percentiles in clear language. Instead of "Show me errors," try "Show me 500 errors from the API service in the last hour." Query Agent performs better with explicit filters, time ranges, and field names.
253
+
***Talk to it like a conversation**. Layer refinements instead of rewriting the whole question. For example, start with "Show me API errors" and then follow up with "group by status code" and "show the last 6 hours".
254
+
***Be specific**. Combine filters, units, and percentiles in clear language. Instead of "Show me errors", try "Show me 500 errors from the API service, grouped by status code" Query Agent performs better with explicit filters, time ranges, and field names.
255
255
***Start with a broad query**. Begin with a query like "Show me the most recent logs" to understand the structure and available fields in your logs, then refine from there.
256
256
***Ask about data tied to dashboards**. Query Agent works best when you reference data sources that already have dashboards built on them. Try asking questions using dashboard panel names or descriptions, even if built on unstructured logs.
257
257
***Disambiguate field names**. If fields have similar names and cause confusion, explicitly specify the field (for example, `<field_name>`) to improve accuracy.
0 commit comments