Skip to content
This repository was archived by the owner on Sep 2, 2025. It is now read-only.

Commit 76f710a

Browse files
author
Tracey Carter
committed
implemented Ada feedback
1 parent c21f904 commit 76f710a

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

logs/severity-key.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ Ensure the correct mapping of your severity key
55
*****************************************************************
66

77
.. meta::
8-
:description: The Log Observer Connect See the spread of error severity levels.
8+
:description: Log Observer Connect relies on the correct mapping of the severity key. Confirm that your severity key is correctly mapped.
99

10-
The Log Observer Connect timeline displays a histogram of logged events over time, grouped by values of the message field :guilabel:`severity`. The severity key is a field that all logs contain. It has the values :guilabel:`DEBUG`, :guilabel:`ERROR`, :guilabel:`INFO`, :guilabel:`UNKNOWN`, and :guilabel:`WARNING`. Your logs might use a different field name for the severity key. Because the severity key in many logs is called "level", Log Observer Connect automatically remaps the log field "level" to "severity".
10+
The Log Observer Connect timeline displays a histogram of logged events over time, grouped by values of the message field :guilabel:`severity`. The severity key is a field that all logs contain. It has the values :guilabel:`DEBUG`, :guilabel:`ERROR`, :guilabel:`INFO`, :guilabel:`UNKNOWN`, and :guilabel:`WARNING`. Your logs might use a different field name for the severity key. Because the severity key in many logs is called :guilabel:`level`, Log Observer Connect automatically remaps the log field :guilabel:`level` to :guilabel:`severity`.
1111

1212
If your logs call the severity key by a different name, that's okay. To ensure that Log Observer Connect can read your field, transform your field name to :guilabel:`severity` or add a :guilabel:`severity` alias to your field name. To transform your field name, see :new-page:`Extract fields from event data using Ingest Processor <https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/IngestProcessor/FieldExtractionPipeline>`. To add an alias to your field name, see :ref:`logs-alias`.

0 commit comments

Comments
 (0)