diff --git a/docs/alerts/webhook-connections/set-up-webhook-connections.md b/docs/alerts/webhook-connections/set-up-webhook-connections.md index 82c536eb55b..134746b4d94 100644 --- a/docs/alerts/webhook-connections/set-up-webhook-connections.md +++ b/docs/alerts/webhook-connections/set-up-webhook-connections.md @@ -128,8 +128,6 @@ We recommend using the new common variables instead of these legacy variables, w - - ### Example payloads #### Slack payload diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index b49020ae4ca..78fc7dbf6b5 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -417,9 +417,46 @@ You'll see this used in our [C2C source docs](/docs/send-data/hosted-collectors/ Use the Docusaurus [Details](https://docusaurus.io/docs/next/markdown-features#details) feature to collapse long, additional content and long code samples. When collapsed, the content can be searched, but not displayed, when loading a page. Place long lists or lots of content in this section. The reader can expand/collapse as needed. Important content like required steps and instructions should not be placed in an expander. -You can include markdown content in expanders including code samples, embedded videos, bulleted lists, and more. +### When to use and when NOT to use `
` tags + +| Use Case | ✅ DO Use | ❌ DO NOT Use | Why | +|:---------|:----------|:--------------|:----| +| **FAQ Sections** | | ❌ Never | **Against GEO principles**: Hidden content negatively impacts Generative Engine Optimization and search visibility. **AI citation fails**: AI tools and search engines cannot properly cite or reference content hidden inside accordion components. FAQ content must be immediately visible and scannable. | +| **Troubleshooting Sections** | | ❌ Never | Users searching for solutions need immediate visibility of troubleshooting steps. Hidden content creates friction and poor user experience. | +| **Critical Instructions** | | ❌ Never | Required steps, warnings, or important information must always be visible. Users should not need to click to reveal essential information. | +| **Short Content** | | ❌ Avoid | If collapsed content is only 2-5 lines, keep it visible. The expand/collapse interaction adds unnecessary friction. | +| **Primary Documentation Flow** | | ❌ Avoid | Main concepts and procedures should not be hidden behind accordions. Core content must be scannable. | +| **Long Code Samples** | ✅ Yes | | Code samples over 100 lines of JSON, YAML, or configuration examples benefit from collapsing to reduce page scrolling. | +| **Multiple Installation Methods** | ✅ Yes | | When documenting 3+ installation methods (UI installer, command-line, package managers), collapse each method so users can choose their preferred approach. | +| **API Endpoint Documentation** | ✅ Yes | | Collapse detailed request parameters, response formats, and examples to keep API reference pages scannable. | +| **Alternative Configuration Options** | ✅ Yes | | When showing different setup paths or service configurations (e.g., AWS regions, authentication methods), collapse alternatives to reduce clutter. | +| **Sample Log Formats** | ✅ Yes | | Lengthy log examples (50+ lines) that users reference occasionally should be collapsed. | + +:::warning Important +Using `
` tags for FAQ and troubleshooting content violates **Generative Engine Optimization (GEO)** best practices and prevents AI tools from properly citing your documentation. Always keep FAQ and troubleshooting content visible. +::: + +### Format FAQ questions as headings + +Write each FAQ question as a heading, not as bold text. Headings create discrete, retrievable units that answer engines and AI tools can chunk and cite individually, while bold is purely visual and carries no semantic weight. Use an `H3` for questions directly under an `H2` FAQ section (for example, `## FAQs` → `### How do I reset my password?`), and an `H4` for questions grouped under an `H3` sub-category (for example, `### Security and privacy` → `#### Is my data encrypted?`). + +#### How to use collapsible sections -Add a title for the expander between the `` tags. Then, add all content after `` tags and before the closing `
` tags. +When using `
` tags for appropriate content (see table above), follow these guidelines: + +1. **Always include a descriptive title** in the `` tag. This title should clearly describe what content is collapsed. +2. **Add the `title` attribute** to the `
` tag for better accessibility and SEO. +3. You can include markdown content in expanders including code samples, embedded videos, bulleted lists, and more. +4. Add all content after the `` tags and before the closing `
` tag. + +```markdown +
+Install Using the Command-Line Installer + +Your installation steps and code samples go here... + +
+``` ` tags. Then, add all content - - ## Contractions Using contractions contributes to our goals of striking a conversational, friendly tone. diff --git a/docs/get-started/sumo-logic-ui.md b/docs/get-started/sumo-logic-ui.md index 23a4a8a22c0..efe057fc6db 100644 --- a/docs/get-started/sumo-logic-ui.md +++ b/docs/get-started/sumo-logic-ui.md @@ -207,34 +207,23 @@ You'll need Sumo Logic Administrator role privileges to perform most of these t This FAQ provides answers to common questions about the Sumo Logic UI redesign, which involves transitioning from the legacy Classic UI to the New UI. -
-Q: What is being launched? - +### What is being launched? We are excited to introduce the Sumo Logic Unified Experience, internally known as Project Kanso, inspired by the Japanese principle of simplicity and clutter elimination. This initiative integrates the capabilities of our Log Analytics, Cloud SIEM, and Cloud SOAR into a unified navigation system. Alongside this integration, we have implemented several user interface enhancements to make all Sumo Logic features more accessible and user-friendly. -
- -
-Q: What issues does the New UI resolve? +### What issues does the New UI resolve? The disparate user interface and varying navigation patterns among Log Analytics, Cloud SIEM, and Cloud SOAR have made it challenging for users to effectively utilize these tools together for monitoring and troubleshooting. The current information architecture and navigation system have not effectively showcased useful functionalities to users. It's structured around tools like Traces, Log Search, and Metric Search rather than focusing on user-centric use cases. This places a burden on users to discover these functionalities. In-app tabs present performance and usability challenges since they all operate within a single browser tab. These tabs disrupt native browser navigation features like the back button and tab grouping. The New UI navigation lets you leverage native browser capabilities and customize tab organization according to your preferences. -
- -
-Q: What changes have been implemented that enhance my Sumo Logic experience? +### What changes have been implemented that enhance my Sumo Logic experience? * **Unified Navigation**. You'll now notice a uniform navigation system across Log Analytics, Cloud SIEM, and Cloud SOAR products, ensuring a consistent experience for Sumo Logic users engaged in both observability and security use cases. * **Improved Product Discoverability**. The left nav panel now organizes product features in a solution-centric manner, emphasizing key use cases like infrastructure monitoring, application monitoring, log analysis, security monitoring, and analytics. This reorganization aims to facilitate easier access to Sumo Logic's product features. * **Enhanced Browsing Experience and Accelerated Performance**. In-app tabs will be replaced with native browser tabs, significantly improving _First Contentful Paint_ (FCP) and _Time to Interactive_ (TTI) metrics. With this change, you'll experience faster page load times and ability to organize tabs the way you are used to with other applications. * **Stateful URLs**. Most of the page URLs will now be stateful, allowing you to easily share content with your team members. Any changes made in the UI will be reflected in the URL parameters, making it simple for you to copy and share URLs. Additionally, this feature enables users to navigate back to previous states effortlessly by using the browser. -
- -
-Q: With all Sumo Logic tabs being grouped together in one browser tab, how can I prevent an excessive amount of tabs in my browser? +### With all Sumo Logic tabs being grouped together in one browser tab, how can I prevent an excessive amount of tabs in my browser? We understand that the removal of in-app tabs in the New UI is a significant change in our user workflow, eliciting mixed feedback. While some users appreciate the convenience of consolidated tabs within the app, others question the need for this change. Addressing performance concerns, consolidating tabs aims to reduce browser clutter, albeit potentially complicating session management. For users who prefer centralized Sumo Logic tabs, we recommend utilizing [tab grouping functionality](#customize-your-environment-withtabs) for a seamless experience. | Classic UI | New UI | @@ -244,21 +233,14 @@ We understand that the removal of in-app tabs in the New UI is a significant cha | Performance degrades over long usage because user is using one browser tab. | Memory usage is distributed over different tabs. | | Tab switches reload the tab. | Tab switches won’t reload the tab. This will accelerate time to load, which is especially useful for data-rich features like Dashboards. | -
- -
-Q: Will the New UI retain the Classic UI feature of remembering previously opened tabs from my previous session? - +### Will the New UI retain the Classic UI feature of remembering previously opened tabs from my previous session? After analyzing tab usage data, we've found that a minimal portion of previously opened tabs are actively utilized by our users. Consequently, the Sumo Logic UI often remains cluttered with multiple unused tabs. With the introduction of the New UI experience, if you fail to close browser tabs from previous sessions, they will automatically reload upon login. Tab reload Moreover, we've made the **Recents** feature more prominent in the navigation bar and plan to extend it to other content types which will make it easier for users to open recently opened tabs. -
- -
-Q: How do I access the Classic UI? +### How do I access the Classic UI? The New UI is the future of Sumo Logic, offering better performance, easier navigation, and exclusive new features. While we understand that transitions take time, we strongly recommend using the New UI for the best experience. If you switch back to the Classic UI, you will not have access to: @@ -273,8 +255,6 @@ The Classic UI will be retired in 2025 and will no longer receive updates. The e We encourage you to stay in the New UI and take advantage of its benefits! -
- ## Get support For questions or issues, contact [Support](https://support.sumologic.com/) or join our [Sumo Logic Slack](https://sumodojo.slack.com/) channel. diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source.md index 919f9ebfd52..71390df36b6 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source.md @@ -131,12 +131,9 @@ https://github.com/SumoLogic/sumologic-documentation/blob/main/static/files/c2c/ ``` ## Troubleshooting -
- This request is throttled. Please try again after the value specified in the Retry-After header. -
- This error occurs when the API request limit (throttling threshold) is exceeded and the source makes more API calls than the limit specified in the [Microsoft documentation](https://learn.microsoft.com/en-us/graph/throttling-limits#identity-and-access-reports-service-limits). In many cases, this happens when the same credentials are used concurrently by multiple vendors or integrations. Please verify that the credentials configured for the Sumo Logic source are not shared with other platforms making API calls. -
-
+### This request is throttled. Please try again after the value specified in the Retry-After header. + +This error occurs when the API request limit (throttling threshold) is exceeded and the source makes more API calls than the limit specified in the [Microsoft documentation](https://learn.microsoft.com/en-us/graph/throttling-limits#identity-and-access-reports-service-limits). In many cases, this happens when the same credentials are used concurrently by multiple vendors or integrations. Please verify that the credentials configured for the Sumo Logic source are not shared with other platforms making API calls. ## FAQ diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md index ace666f7415..9ec015539f7 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md @@ -344,7 +344,7 @@ The client will automatically handle HTTP 429 response status codes that include
10. (Optional) **Polling Interval**. Set how frequently to poll for new data. It must be between 5 minutes and 48 hours -1. When you are finished configuring the Source, click **Save**. +11. When you are finished configuring the Source, click **Save**. ## JSON schema @@ -582,40 +582,23 @@ We recommend using [this code snippet](https://goplay.tools/snippet/WTFe5ZLU9PO) ## Troubleshooting -
- - Errors related to partial log ingestion, log preparation, timestamp extraction, or response parsing - -
- Possible resolution -
    -
  • Ensure that the HTTP Response Log Ingest Configuration matches the API response structure.
    • -
  • Verify that all configured fields exist in the API response.
    • -
  • Confirm that the API response is returned in valid JSON format.
    • -
-
-
+### Errors related to partial log ingestion, log preparation, timestamp extraction, or response parsing -
- Error getting partial logs, error preparing log, error getting timestamp data, timestamp path not in data, or error parsing response data -
- These errors are typically caused by an improper endpoint response format or incorrect log ingestion configuration. Ensure that your endpoint returns data in a valid JSON format and response fields are as per the configuration. -
-
+- Ensure that the HTTP Response Log Ingest Configuration matches the API response structure. +- Verify that all configured fields exist in the API response. +- Confirm that the API response is returned in valid JSON format. -
- oauth2: cannot parse json: invalid character -
- This error occurs due to an OAuth 2.0 authentication misconfiguration. Reconfigure the source using valid OAuth 2.0 credentials and ensure that it aligns with the steps in the [Authentication Configuration](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source#source-configuration) section. -
-
+### Error getting partial logs, error preparing log, error getting timestamp data, timestamp path not in data, or error parsing response data -
- Failed to validate the base request config or error preparing new request -
- These errors indicate that the endpoint configuration is not set up correctly. Verify that your endpoint configuration follows the instructions in the [Request Configuration](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source#source-configuration) section. -
-
+These errors are typically caused by an improper endpoint response format or incorrect log ingestion configuration. Ensure that your endpoint returns data in a valid JSON format and response fields are as per the configuration. + +### oauth2: cannot parse json: invalid character + +This error occurs due to an OAuth 2.0 authentication misconfiguration. Reconfigure the source using valid OAuth 2.0 credentials and ensure that it aligns with the steps in the [Authentication Configuration](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source#source-configuration) section. + +### Failed to validate the base request config or error preparing new request + +These errors indicate that the endpoint configuration is not set up correctly. Verify that your endpoint configuration follows the instructions in the [Request Configuration](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source#source-configuration) section. ## FAQ @@ -623,18 +606,14 @@ We recommend using [this code snippet](https://goplay.tools/snippet/WTFe5ZLU9PO) Click [here](/docs/c2c/info) for more information about Cloud-to-Cloud sources. ::: -
- What if I want to query multiple HTTP endpoints? -
You will need to create a new source per endpoint for the data you wish to collect, even if the endpoint is within the same API.
-
-
- Can I transform the data collected? -
No, this source only collects the data. You can use the Sumo Logic platform features to parse/transform the data further after collection.
-
-
- What timestamp is used for the data? -
If you leave the time parsing configuration blank, it will cause the source to use current time for the collected logs. Be sure to configure the HTTP response log ingestion configuration section to ensure time parsing is correctly handled. The source will enter an error health status if time parsing is configured and is unsuccessful.
-
+### What if I want to query multiple HTTP endpoints? +You will need to create a new source per endpoint for the data you wish to collect, even if the endpoint is within the same API. + +### Can I transform the data collected? +No, this source only collects the data. You can use the Sumo Logic platform features to parse/transform the data further after collection. + +### What timestamp is used for the data? +If you leave the time parsing configuration blank, it will cause the source to use current time for the collected logs. Be sure to configure the HTTP response log ingestion configuration section to ensure time parsing is correctly handled. The source will enter an error health status if time parsing is configured and is unsuccessful. :::note By default, this source supports up to *512 MB* of memory in a single API response. For higher limits or additional requirements, contact Sumo Logic Support.