You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/manage/content-sharing/changing-alerts.md
+4-18Lines changed: 4 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,32 +21,18 @@ If you're using a search template with your saved search, you cannot modify the
21
21
To edit an alert:
22
22
23
23
1. Go to the Sumo Logic library by clicking the folder icon in the main Sumo Logic menu: <img src={useBaseUrl('img/reuse/library-icon.png')} alt="Library icon" style={{border: '1px solid gray'}} width="30" />
24
-
25
24
1. Click in the search area to display a list of library object types, and choose **Scheduled Searches**.
26
-
27
-
1. Select the edit icon in the library for the scheduled search you'd like to edit.
1. Select the edit icon in the library for the scheduled search you'd like to edit.<br/><img src={useBaseUrl('img/content-sharing/EditAlert.png')} alt="Select the edit icon in the library" style={{border: '1px solid gray'}} width="800" />
1. Modify the frequency, time range, and alert type as needed.<br/><img src={useBaseUrl('img/content-sharing/EditAlert3.png')} alt="Modify the alert" style={{border: '1px solid gray'}} width="600" />
39
28
1. Click **Update** to save your changes.
40
29
41
30
## Cancel alerts on a shared search
42
31
43
32
If you have Edit permissions on the shared search, you can stop recipients from receiving alerts by setting the run frequency to **Never**. We recommend doing this when a search is no longer relevant rather than deleting the search so that it can be available to you later if you need it. Deleting the shared search is possible, if you have Manage permissions, but does not allow you the ability to restore a scheduled search later if you need it.
44
33
45
34
1. Navigate to the scheduled search you want to edit, as described above in [Edit an alert](#edit-an-alert).
46
-
1. Select the edit icon in the library for the scheduled search.
1. Select the edit icon in the library for the scheduled search.<br/><img src={useBaseUrl('img/content-sharing/EditAlert.png')} alt="Select the edit icon in the library" style={{border: '1px solid gray'}} width="800" />
50
36
1. In the **Edit Search** dialog, click **Edit this search's schedule**.
51
37
1. From the **Run Frequency** menu, choose **Never** to cancel the scheduled search.
1. Click the details icon <img src={useBaseUrl('img/content-sharing/details.png')} alt="Details icon" style={{border: '1px solid gray'}} width="20" /> for the content you want to share.
45
+
1. Select **Share** from the dropdown menu.<br/><img src={useBaseUrl('img/content-sharing/share-search.png')} alt="Share search" width="150"/>
48
46
49
47
:::note
50
48
* The **Share** option appears on the dropdown menu only if you have permissions to grant access. See [Available permission levels](#available-permission-levels).
Copy file name to clipboardExpand all lines: docs/manage/data-archiving/archive.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -184,7 +184,7 @@ Click on a table row to view the Source details. This includes:
184
184
***Description**
185
185
***AWS S3 bucket**
186
186
* All **Ingestion jobs** that are and have been created on the Source.
187
-
* Each ingestion job shows the name, time window, and volume of data processed by the job. Click the icon  to the right of the job name to start a Search against the data that was ingested by the job.
187
+
* Each ingestion job shows the name, time window, and volume of data processed by the job. Click the icon <img src={useBaseUrl('img/archive/open-search-icon.png')} alt="Open in search icon" width="30" /> to the right of the job name to start a Search against the data that was ingested by the job.
188
188
* Hover your mouse over the information icon to view who created the job and when.<br/><img src={useBaseUrl('img/archive/archive-details-pane.png')} alt="Archive details pane" width="325"/>
Copy file name to clipboardExpand all lines: docs/manage/field-extractions/create-field-extraction-rule.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,6 +4,7 @@ title: Create a Field Extraction Rule
4
4
description: Field Extraction Rules (FER) tell Sumo Logic which fields to parse out automatically.
5
5
---
6
6
7
+
import useBaseUrl from '@docusaurus/useBaseUrl';
7
8
import Iframe from 'react-iframe';
8
9
import FerLimit from '../../reuse/fer-limitations.md';
9
10
@@ -47,7 +48,7 @@ To create a Field Extraction Rule:
47
48
48
49
1.[**New UI**](/docs/get-started/sumo-logic-ui). To access the Field Extraction Rules page, in the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
49
50
1. Click the **+ Add** button on the top right of the table.
50
-
1. The **Add Field Extraction Rule** form will appear:<br/>
51
+
1. The **Add Field Extraction Rule** form will appear:<br/><img src={useBaseUrl('img/field-extraction-rules/create-fer.png')} alt="Create Field extraction rule with dynamic parsing" style={{border: '1px solid gray'}} width="400" />
51
52
1. Enter the following options:
52
53
***Rule Name**. Type a name that makes it easy to identify the rule.
53
54
***Applied At**. There are two types available, Ingest Time and Run Time. The main differences are Run Time only supports JSON data and the time that Sumo parses the fields. The following is an overview of the differences:
Copy file name to clipboardExpand all lines: docs/manage/field-extractions/index.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,7 +33,7 @@ The Field Extraction Rules page displays the following information:
33
33
34
34
When hovering over a row in the table there are icons that appear on the far right for editing, disabling and deleting the rule.
35
35
36
-
***Status** shows a checkmark in a green circle  to indicate if the Rule is actively being applied or an exclamation mark in a red circle  to indicate if the Rule is disabled.
36
+
***Status** shows a checkmark in a green circle <img src={useBaseUrl('img/reuse/green-check-circle.png')} alt="Check in green circle" width="20" /> to indicate if the Rule is actively being applied or an exclamation mark in a red circle <img src={useBaseUrl('img/reuse/exclamation-red-circle.png')} alt="Exclamation in red circl" width="20" /> to indicate if the Rule is disabled.
37
37
***Rule Name**
38
38
***Applied At** indicates when the field extraction process occurs, either at Ingest or Run time.
In the above example, we have created a new field called `cluster` and set the value to `k8s.dev`. With this configuration, any logs sent to this Collector will now have this key-value pair associated with it.
92
92
93
93
With this association, you can search for `cluster=k8s.dev` to return your logs.
94
94
95
-

When creating or editing your HTTP Source that will receive log data add the field `_convertHeadersToFields` with a value of `true`. This field needs to be added to your Fields schema to work.
With this field set on your Source, headers are processed as metadata fields. For example, a cURL command posting data with custom fields would look like:
187
187
@@ -235,7 +235,7 @@ You need the **Manage Fields** [role capability](users-roles/roles/role-capab
235
235
236
236
The Fields page displays the following information:
237
237
238
-
***Status** shows a checkmark in a green circle <img src={useBaseUrl('img/reuse/green-check-circle.png')} alt="green check circle.png" width="20"/> to indicate if the field is actively being applied or an exclamation mark in a red circle  to indicate if the field is disabled and being dropped.
238
+
***Status** shows a checkmark in a green circle <img src={useBaseUrl('img/reuse/green-check-circle.png')} alt="green check circle.png" width="20"/> to indicate if the field is actively being applied or an exclamation mark in a red circle <img src={useBaseUrl('img/fields/red-exclamation-circle.png')} alt="Red exclamation circle" width="20" /> to indicate if the field is disabled and being dropped.
239
239
***Field Name** is the name of the field, known as the key in the key-value pair.
240
240
***Data Type** shows the data type of the field.
241
241
***Field Extraction Rules** shows the number of Field Extraction Rules that reference the field.
@@ -263,16 +263,14 @@ When hovering over a row in the table there are icons that appear on the far ri
263
263
264
264
For the fields listed, select a row to view its details. A details pane appears to the right of the table where you can disable and delete the field.<br/><img src={useBaseUrl('/img/fields/selected-field-details-pane.png')} alt="Manage Fields" style={{border:'1px solid gray'}} width="450"/>
265
265
266
-

267
-
268
266
#### Add field
269
267
270
268
Adding a field will define it in the Fields schema allowing it to be assigned as metadata to your logs.
271
269
272
270
1. Click the **+ Add** button on the top right of the table. A panel named **Add Field** appears to the right of the fields table.
273
271
1. Input a field name and click **Save**.
274
272
275
-

@@ -290,15 +288,15 @@ In the details pane of the field, click the **Disable** button.<br/><img src={u
290
288
Deleting a field does not delete historical data assigned with that field. If you delete a field by mistake and one or more of those dependencies break, you can re-add the field to get things working properly again. You should always disable a field and ensure things are behaving as expected before deleting a field.
291
289
:::
292
290
293
-
Select the **Delete** button in the details pane of the field. To delete a field you need to remove any references to it from some features. If the field is used by any of the following
291
+
Select the **Delete** button in the details pane of the field. To delete a field you need to remove any references to it from some features if the field is used by any of the following:
Copy file name to clipboardExpand all lines: docs/manage/health-events.md
+9-12Lines changed: 9 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,6 +4,8 @@ title: Health Events
4
4
description: Monitor the health of your Collectors and Sources.
5
5
---
6
6
7
+
import useBaseUrl from '@docusaurus/useBaseUrl';
8
+
7
9
## Availability
8
10
9
11
| Account Type | Account Level |
@@ -40,11 +42,11 @@ On the health events table, you can search, filter, and sort incidents by ke
40
42
41
43
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To access the health events table, in the main Sumo Logic menu select **Manage Data > Monitoring > Health Events**.
Click the **Create Scheduled Search** button on the details pane to get alerts for specific health events. The unique identifier of the resource, such as the Source or Collector, is used in the query. See [Schedule a Search](../alerts/scheduled-searches/schedule-search.md) for details.
50
52
@@ -57,8 +59,8 @@ Under the **More Actions** menu you can select:
57
59
58
60
Events are categorized by two severity levels, warning and error. The severity column has color-coded error and warning events so you can quickly determine the severity of a given issue.
59
61
60
-
* A warning indicates the Collector or Source has a configuration issue or is operating in a degraded state.
61
-
* An error indicates the Collector or Source is unable to collect data as expected.
62
+
*<img src={useBaseUrl('img/health-events/warning-label.png')} alt="Warning label" style={{border: '1px solid gray'}} width="75" /> A warning indicates the Collector or Source has a configuration issue or is operating in a degraded state.
63
+
*<img src={useBaseUrl('img/health-events/Error-label.png')} alt="Error label" style={{border: '1px solid gray'}} width="50" /> An error indicates the Collector or Source is unable to collect data as expected.
62
64
63
65
### Common parameters
64
66
@@ -138,12 +140,7 @@ A **Health** column on the Collection page shows color-coded healthy, error, a
138
140
139
141
The **status** column now shows the status of Sources manually paused by users.
140
142
141
-

142
-
143
-
* Hover your mouse over a Collector or Source to view a tooltip that provides the number of health events detected on the Collector or Source.
* Hover your mouse over a Collector or Source to view a tooltip that provides the number of health events detected on the Collector or Source.<br/><img src={useBaseUrl('img/health-events/health_tooltip.png')} alt="Health tooltip" style={{border: '1px solid gray'}} width="150" />
146
+
* Click on the **Health** status in a row to view a pop-up displaying a list of related events.<br/><img src={useBaseUrl('img/health-events/object_event_details.png')} alt="Object event details" style={{border: '1px solid gray'}} width="500" />
Copy file name to clipboardExpand all lines: docs/manage/ingestion-volume/collection-status-page.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,12 +4,13 @@ title: Collection Status Page
4
4
description: Provides a visual snapshot of the message history for your deployment, and a message volume histogram for each Collector.
5
5
---
6
6
7
+
import useBaseUrl from '@docusaurus/useBaseUrl';
7
8
8
9
The Status page provides a message volume history for your account, as well as a message volume histogram for each Collector, giving you immediate visual feedback about traffic spikes or collection issues. To see statistics for any bar in the histogram, hover your mouse pointer over the area of interest.
9
10
10
11
When you first install a Collector it is common to configure Sources to collect some historical data, rather than from the moment of installation. In this case, the status page shows a spike in message volume and then levels out as collection reaches a steady state. For example, a local log file can contain millions of log messages. When the Collector is initialized, it quickly gathers all those logs and sends them to Sumo Logic resulting in a traffic spike. After the initial collection, the Collector continues to tail the file, reading from the end of the file as new entries are created, and sends a smaller number of new log messages.
Copy file name to clipboardExpand all lines: docs/manage/ingestion-volume/data-volume-index/log-tracing-data-volume-index.md
+5-3Lines changed: 5 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,6 +4,8 @@ title: Log and Tracing Data Volume Index
4
4
description: The Data Volume Index is populated with a set of log messages that contain information on how much data (by bytes and messages count) your account is ingesting.
5
5
---
6
6
7
+
import useBaseUrl from '@docusaurus/useBaseUrl';
8
+
7
9
The data volume index is populated with a set of log messages every five minutes. The messages contain information on how much data (by bytes and messages count) your account is ingesting. Your data volume is calculated based on when your logs were received, in Sumo this timestamp is stored with the `_receiptTime`[metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field. Each log message includes information based on one of the following index source categories.
0 commit comments