Skip to content

Commit fdbd1df

Browse files
committed
Update Log Search config options
1 parent 207a5bc commit fdbd1df

File tree

7 files changed

+89
-91
lines changed

7 files changed

+89
-91
lines changed

docs/search/get-started-with-search/build-search/dynamic-parsing.md

Lines changed: 70 additions & 83 deletions
Large diffs are not rendered by default.

docs/search/get-started-with-search/build-search/use-receipt-time.md

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,33 @@ title: Use Receipt Time
44
description: You can display search results in the order that the Collector received the messages in milliseconds.
55
---
66

7+
import useBaseUrl from '@docusaurus/useBaseUrl';
8+
9+
<!-- When Intelliparse goes GA, structure:
10+
11+
Parsing
12+
* Intelliparse
13+
* Auto Parse
14+
* Manual
15+
16+
Timestamp
17+
* Message Time
18+
* Receipt Time
19+
20+
-->
21+
22+
By default, log searches run by Message time. Enable the **Use Receipt Time** setting to run the search by Receipt time, which is the timestamp when a log message hits the Sumo Logic receivers.
723

824
To search data based on the order that Collectors received the messages use **Receipt Time**. This option has the search reference the [metadata](../search-basics/built-in-metadata.md) field `_receiptTime` instead of `_messageTime`, giving you the ability to view the difference in the parsed [timestamp](/docs/send-data/reference-information/time-reference) (`_messageTime`) and receipt time (`_receiptTime`) to pinpoint Sources that may be parsing the message's timestamps incorrectly.
925

1026
## Run a search by Receipt Time
1127

12-
To run a search by Receipt Time:
28+
To run a log search by Receipt Time:
1329

1430
1. Enter your query in the search text box.
1531
1. Choose the Time Range for the query.
16-
1. Click the gear icon to open the **Search Config** menu and toggle **Use Receipt Time** on.
17-
18-
![receipt time option.png](/img/search/get-started-search/build-search/receipt-time-option.png)
19-
 
20-
1. Review the search results for wide discrepancies between message timestamp and receipt time to pinpoint Sources with incorrect timestamps:
21-
22-
![receipt time results in messages tab.png](/img/search/get-started-search/build-search/receipt-time-results-messages-tab.png)
32+
1. Click the gear icon to open the **Search Config** menu and toggle on **Use Receipt Time**.<br/><img src={useBaseUrl('img/search/get-started-search/build-search/receipt-time-option.png')} alt="receipt time option.png" style={{border: '1px solid gray'}} width="450"/>
33+
1. Review the search results for wide discrepancies between message timestamp and receipt time to pinpoint Sources with incorrect timestamps:<br/><img src={useBaseUrl('img/search/get-started-search/build-search/receipt-time-results-messages-tab.png')} alt="receipt time results in messages tab.png" width="700"/>
2334

2435
## Resolving timestamp/receipt time issues
2536

17.9 KB
Loading
34 KB
Loading
13.7 KB
Loading
Binary file not shown.
Binary file not shown.

0 commit comments

Comments
 (0)