From 69168c0f1b98320f42217223aa15f8289e9ba6e9 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 26 Aug 2026 00:34:17 -0700 Subject: [PATCH 1/4] DOCS-1829 - Reorganize Get Started with Search sidebar into 5 categories Split the 4 overlapping categories (Search Basics, How to Use the Search Page, Build Searches, Suggested Searches) into 5 clearer ones: Search Basics, Build Searches, Search Results, Manage Searches, and Suggested Searches. Docs are regrouped by category without moving any files on disk, so no URLs change and no redirects are needed. Also reorders items within each category to teach fundamentals before edge cases (e.g. Search Modes and Search Autocomplete now lead Build Searches; Comments in Search Queries moves to the end of Search Basics since it depends on already knowing how to write a query). Co-Authored-By: Claude Sonnet 5 --- .../build-search/index.md | 33 +++++--- docs/search/get-started-with-search/index.md | 16 ++-- .../manage-searches/index.md | 41 ++++++++++ .../search-basics/index.md | 81 ++++--------------- .../search-page/index.md | 47 +++++++---- sidebars.ts | 73 +++++++++-------- 6 files changed, 156 insertions(+), 135 deletions(-) create mode 100644 docs/search/get-started-with-search/manage-searches/index.md diff --git a/docs/search/get-started-with-search/build-search/index.md b/docs/search/get-started-with-search/build-search/index.md index fa9f3903e85..9c432596aea 100644 --- a/docs/search/get-started-with-search/build-search/index.md +++ b/docs/search/get-started-with-search/build-search/index.md @@ -1,12 +1,13 @@ --- slug: /search/get-started-with-search/build-search -title: Build Searches +title: How to Write and Run a Sumo Logic Search Query +sidebar_label: Build Searches description: Details on building a search - best practices, syntax, time range, and efficient searches. These simple queries will help you discover what data you have in your Sumo Logic environment. An efficient search query returns targeted results as quickly as possible, with as little "noise" as possible. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This guide provides information on building searches. +How do you actually write and run a log search query? This guide covers the UI mechanics of building a search: autocomplete, search modes, time ranges, and best practices for efficient queries. In this section, we'll introduce the following concepts: @@ -25,14 +26,20 @@ In this section, we'll introduce the following concepts:
- Frequent Search icon

Keyword Search Expressions

 -

Learn how to define the scope of data for the query.

+ Frequent Search icon

Launch a Search from the Collection Page

 +

Quickly start a search for a Collector, Source, or Source Category from the Manage Collection page.

- Frequent Search icon

Search Syntax Overview

 -

Learn about query syntax and how to construct a search.

+ Frequent Search icon

Search Autocomplete

 +

The search autocomplete dropdown dialog offers suggestions to make query writing easier.

+
+
+
+
+ Frequent Search icon

Search Modes

 +

Learn about the new search modes of our Log Search page.

@@ -55,7 +62,7 @@ In this section, we'll introduce the following concepts:
- Frequent Search icon

Use Searchbale Time

 + Frequent Search icon

Use Searchable Time

Learn how to display search results in the order when the logs become available for search.

@@ -67,11 +74,11 @@ In this section, we'll introduce the following concepts: -## What Data Do I Have? +## What data do I have? -It can be hard to create a search query if you do not know what data you have in your Sumo Logic environment.  +It can be hard to create a search query if you do not know what data you have in your Sumo Logic environment. -You can use the following simple queries to identify possible values for your existing Source Categories, Source Names, and Source Hosts. You can also approximate data volume for each of the possible values using these queries. +You can use the following simple queries to identify possible values for your existing Source Categories, Source Names, and Source Hosts. You can also approximate data volume for each of the possible values using these queries. We discourage the use of `*`, as it does not provide much value, but in this exception, it is an easy way to identify all messages received in the last 5 minutes, and provide an approximate volume for each. @@ -81,7 +88,7 @@ For Source Hosts: `* | count_frequent(_sourceHost)` For Source Names: `* | count_frequent(_sourceName)` -## Write Efficient Search Queries +## Write efficient search queries ### Make the search as selective as possible @@ -90,7 +97,7 @@ The more specific the query, the more efficiently it will run, as unnecessary me * `* | parse regex "uid=(?\d+)"` * `"uid=" | parse regex "uid=(?\d+)"` -The second query will return the results more efficiently because the first query includes `"*"`, which prompts Sumo Logic to comb through all messages for the given time range. +The second query will return the results more efficiently because the first query includes `"*"`, which prompts Sumo Logic to comb through all messages for the given time range. ### Use Field Extraction Rules @@ -106,4 +113,4 @@ For example, look at the following queries: `* | parse "queryTime=* " as queryTime | where queryTime\> 10000 | parse "uid=* " as ``uid` -Because most log lines have a `uid`, but only a small fraction have `queryTime > 10000`, the second query is more efficient. +Because most log lines have a `uid`, but only a small fraction have `queryTime > 10000`, the second query is more efficient. diff --git a/docs/search/get-started-with-search/index.md b/docs/search/get-started-with-search/index.md index 4ec2911ca7e..81fe6b81cf1 100644 --- a/docs/search/get-started-with-search/index.md +++ b/docs/search/get-started-with-search/index.md @@ -1,6 +1,6 @@ --- slug: /search/get-started-with-search -title: Getting Started with Search +title: Getting Started with Log Search description: Start here to begin exploring your data in Sumo Logic. --- @@ -37,14 +37,20 @@ In this section, we'll introduce the following concepts:
- Search icon

Using the Search Page

-

Understand the basic components of the Search window and how they can help you investigate your issues.

+ Search icon

Build Searches

+

Details on building a search - best practices, syntax, time range, and efficient searches.

- Search icon

Build Searches

-

Details on building a search - best practices, syntax, time range, and efficient searches.

+ Search icon

Search Results

+

See what happens after you run a search — navigate, chart, export, and interact with your results.

+
+
+
+
+ Search icon

Manage Searches

+

Save, share, pin, favorite, pause, or cancel your searches so you can reuse and revisit them later.

diff --git a/docs/search/get-started-with-search/manage-searches/index.md b/docs/search/get-started-with-search/manage-searches/index.md new file mode 100644 index 00000000000..37f7366d327 --- /dev/null +++ b/docs/search/get-started-with-search/manage-searches/index.md @@ -0,0 +1,41 @@ +--- +slug: /search/get-started-with-search/manage-searches +title: Managing Log Searches +sidebar_label: Manage Searches +description: Save, share, pin, favorite, pause, or cancel your Sumo Logic searches so you can reuse and revisit them later. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +How do you reuse or control a search over time? Save, share, pin, favorite, pause, or cancel your Sumo Logic searches so you can revisit them later. + +In this section, we'll introduce the following concepts: + +
+
+
+ Search icon

Pause or Cancel a Search

 +

When a search is in progress, the options to Cancel or Pause the search appear.

+
+
+
+
+ Search icon

Pin a Search

 +

You can pin a search so that it runs in the background independent of the browser session.

+
+
+
+
+ Search icon

Save a Search

 +

Save your favorite searches to run them again later, and mark saved searches as favorites for quick access.

+
+
+
+
+ Search icon

Share a Link to a Search

 +

Learn how to share a link to search query results, or to a specific message, via email or IM.

+
+
+
+ +
diff --git a/docs/search/get-started-with-search/search-basics/index.md b/docs/search/get-started-with-search/search-basics/index.md index a6a938da633..c438796f194 100644 --- a/docs/search/get-started-with-search/search-basics/index.md +++ b/docs/search/get-started-with-search/search-basics/index.md @@ -1,19 +1,20 @@ --- slug: /search/get-started-with-search/search-basics -title: Search Basics -description: Sumo Logic search syntax uses logical and familiar operators allowing you to create ad hoc queries quickly and efficiently. +title: Log Search Basics +sidebar_label: Search Basics +description: Sumo Logic search syntax and concepts use logical, familiar operators for writing accurate queries quickly. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -Sumo Logic search syntax uses logical and familiar operators allowing you to create ad hoc queries quickly and efficiently. +What do you need to know before you start typing a query? Sumo Logic search syntax and concepts use logical, familiar operators for writing accurate queries quickly. In this section, we'll introduce the following concepts:
- Advanced Search icon

About Search Basics

 + Advanced Search icon

How Sumo Logic Search Query Syntax Works

Sumo Logic search syntax, based on a funnel concept, uses logical and familiar operators allowing you to create queries quickly.

@@ -25,76 +26,28 @@ In this section, we'll introduce the following concepts:
- Advanced Search icon

Chart Search Results

 -

In the Aggregates tab, you can view search results as a chart, such as a bar or column chart.

-
-
-
-
- Advanced Search icon

Comments in Search Queries

 + Advanced Search icon

Add Comments to a Log Search Query

Learn how to add comments to a search query and comment out lines for notes.

- Advanced Search icon

Export Search Results

 -

Up to 100,000 rows can be exported as a CSV text file.

-
-
-
-
- Advanced Search icon

Pause or Cancel a Search

 -

When a search is in progress, the options to Cancel or Pause the search appear.

+ Advanced Search icon

Keyword Search Expressions

 +

Learn how to define the scope of data for the query.

- Advanced Search icon

Quick Search for Collectors and Sources

 -

Quickly start a search for a Collector, Source, or Source Category from the Manage Collection page.

+ Advanced Search icon

Escape Special Characters in a Field Name

 +

Reference a field name that contains a special character.

- Advanced Search icon

Reference a Field with Special Characters

 -

Reference a field name that contains a special character.

+ Advanced Search icon

Search Syntax Overview

 +

Learn about query syntax and how to construct a search.

-
-
- Advanced Search icon

Save a Search

 -

Save your favorite searches to run them again later.

-
-
-
-
- Advanced Search icon

Search Autocomplete

 -

The search autocomplete dropdown dialog offers suggestions to make query writing easier.

-
-
-
-
- Advanced Search icon

Search Large Messages

 -

Learn how to search large log messages, which Sumo Logic slices into smaller message chunks.

-
-
-
-
- Advanced Search icon

Search Surrounding Messages

 -

Investigate events surrounding a message in your Messages list.

-
-
-
-
- Advanced Search icon

Share a Link to a Search

 -

Learn how to share a link to search query results via email or IM.

-
-
-
-
- Advanced Search icon

Share a Message Link to a Search

 -

Share a message link to search query results. Copy and paste the message link to share a search.

-
-
Advanced Search icon

Time Range Expressions

 @@ -103,14 +56,8 @@ In this section, we'll introduce the following concepts:
- Advanced Search icon

View Search Results for JSON Logs

 -

If your search results contain JSON logs, you can show or hide JSON format from the Messages tab.

-
-
-
-
- Advanced Search icon

View Traces Search Results

 -

Open and review traces from search log results.

+ Advanced Search icon

Wildcards in Full Text Searches

 +

You can use wildcards in full text searches.

diff --git a/docs/search/get-started-with-search/search-page/index.md b/docs/search/get-started-with-search/search-page/index.md index 76767d85ab9..5ec36404c3a 100644 --- a/docs/search/get-started-with-search/search-page/index.md +++ b/docs/search/get-started-with-search/search-page/index.md @@ -1,16 +1,17 @@ --- slug: /search/get-started-with-search/search-page -title: How to Use the Search Page -description: Understand the basic components of the Search window and how they can help you investigate your issues. +title: Navigate and Interact with Sumo Logic Search Results +sidebar_label: Search Results +description: Navigate, chart, and export your Sumo Logic search results, and interact with them to investigate issues faster. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -On the Search page, you can enter [simple or complex queries](../search-basics/about-search-basics.md) to search your entire Sumo Logic data repository. You can adjust the size of the search query editor for better visibility into long queries and reduce the size of the editor while examining larger results, making it easier to navigate through your data. +What can you do with what came back? On the Search page, you can enter [simple or complex queries](../search-basics/about-search-basics.md) to search your entire Sumo Logic data repository. You can adjust the size of the search query editor for better visibility into long queries and reduce the size of the editor while examining larger results, making it easier to navigate through your data. -You can also save and select searches from your [Library](/docs/get-started/library). After running a search, your results are displayed in either the **Messages** tab (for raw message data) or the **Aggregates** tab (for grouped results). See [how to navigate through search results](navigate-through-search-results.md). +You can also save and select searches from your [Library](/docs/get-started/library). After running a search, your search results for for raw message data are displayed in the **Messages** tab, while grouped results are displayed the **Aggregates** tab. See [how to navigate through search results](navigate-through-search-results.md). -You can [run a saved search](../search-basics/save-search.md), [pause, or stop searches](../search-basics/pause-cancel-search.md), or [schedule a search to run periodically](../../../alerts/scheduled-searches/schedule-search.md) and notify you of the results. +You can [run a saved search](../search-basics/save-search.md), [pause, or stop searches](../search-basics/pause-cancel-search.md), or [schedule a search to run periodically](../../../alerts/scheduled-searches/schedule-search.md) and notify you of the results. Search page @@ -22,7 +23,7 @@ You can [run a saved search](../search-basics/save-search.md), [pause, or stop | D | Click the gear icon to open the Search Config menu that has the options to use the [receipt time](../build-search/use-receipt-time.md) or [searchable time](../build-search/use-searchable-time.md) timestamps and [Auto Parse Mode](../build-search/dynamic-parsing.md). | | E | [Share a link](../search-basics/share-link-to-search.md) for the currently running search. | | F | [Save or schedule](../search-basics/save-search.md) a search. | -| G | Click the three-dot kebab icon to open a menu with the following options:
  • Select between Basic or Advanced search mode.
  • Link to [search cheat sheets](/docs/search/search-cheat-sheets).
  • Edit the search, if it has already been saved.
  • [Save or schedule](../search-basics/save-search.md) a search.
  • [Share a link](../search-basics/share-link-to-search.md) for the currently running search.
  • Info provides detailed information about the search.
  • [Pin](/docs/search/get-started-with-search/search-page/pin-a-search) the search to run in the background independent of the browser session.
  • [Favorite](add-saved-search-to-favorites.md) a saved search.
  • [Add a new monitor](/docs/alerts/monitors) based on the existing query in the search text box.
  • Use [Live Tail](/docs/search/live-tail) to see a real-time live feed of log events.
The menu options are dynamically provided so depending on if you have run or saved the search or conducted aggregation some options will be grayed out and unclickable. | +| G | Click the three-dot kebab icon to open a menu with the following options:
  • Select between Basic or Advanced search mode.
  • Link to [search cheat sheets](/docs/search/search-cheat-sheets).
  • Edit the search, if it has already been saved.
  • [Save or schedule](../search-basics/save-search.md) a search.
  • [Share a link](../search-basics/share-link-to-search.md) for the currently running search.
  • Info provides detailed information about the search.
  • [Pin](/docs/search/get-started-with-search/search-page/pin-a-search) the search to run in the background independent of the browser session.
  • [Favorite](../search-basics/save-search.md#add-a-saved-search-to-favorites) a saved search.
  • [Add a new monitor](/docs/alerts/monitors) based on the existing query in the search text box.
  • Use [Live Tail](/docs/search/live-tail) to see a real-time live feed of log events.
The menu options are dynamically provided so depending on if you have run or saved the search or conducted aggregation some options will be grayed out and unclickable. | | H | [Histogram](navigate-through-search-results.md) of the messages. | | I | Search Details such as session, status, elapsed time, results, raw count, search expression, and [load](search-load-indicator.md). When searching an [Infrequent Partition](/docs/manage/partitions/data-tiers) the estimated and actual amount of data scanned is displayed. | | J | Search results as messages. | @@ -55,20 +56,20 @@ In this section, we'll introduce the following concepts:
- Search icon

Add a Saved Search to Favorites

 -

You can mark a saved search as a favorite so it appears in your Library.

+ Search icon

Change the Time Range in the Histogram

 +

Learn how to filter results based on a histogram time range.

- Search icon

Pin a Search

 -

You can pin a search so that it runs in the background independent of the browser session.

+ Search icon

Chart Search Results

 +

In the Aggregates tab, you can view search results as a chart, such as a bar or column chart.

- Search icon

Change the Time Range in the Histogram

 -

Learn how to filter results based on a histogram time range.

+ Search icon

Export Search Results as a CSV File

 +

Up to 100,000 rows can be exported as a CSV text file.

@@ -91,7 +92,7 @@ In this section, we'll introduce the following concepts:
- Search icon

Modify a Search from the results table

 + Search icon

Modify a Search from the Results Table

Modify past searches by selecting text displayed in the Messages tab.

@@ -107,6 +108,12 @@ In this section, we'll introduce the following concepts:

When your search results are returned, your search terms are highlighted in the Messages tab.

+
+
+ Search icon

Find Truncated Large Log Messages

 +

Learn how to search large log messages, which Sumo Logic slices into smaller message chunks.

+
+
Search icon

Search Load Indicator

 @@ -115,8 +122,8 @@ In this section, we'll introduce the following concepts:
- Search icon

Search Modes

 -

Learn about the new search modes of our Log Search page.

+ Search icon

View Messages Surrounding a Specific Log Entry

 +

Investigate events surrounding a message in your Messages list.

@@ -127,8 +134,14 @@ In this section, we'll introduce the following concepts:
- Search icon

Wildcards in Full Text Searches

 -

You can use wildcards in full text searches.

+ Search icon

View Search Results for JSON Logs

 +

If your search results contain JSON logs, you can show or hide JSON format from the Messages tab.

+
+
+
+
+ Search icon

Open Trace Data from Search Results

 +

Open and review traces from search log results.

diff --git a/sidebars.ts b/sidebars.ts index 71cca5484a2..a1458515e67 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -1401,34 +1401,45 @@ module.exports = { link: {type: 'doc', id: 'search/get-started-with-search/search-basics/index'}, items: [ 'search/get-started-with-search/search-basics/about-search-basics', + 'search/get-started-with-search/build-search/search-syntax-overview', + 'search/get-started-with-search/build-search/keyword-search-expressions', 'search/get-started-with-search/search-basics/built-in-metadata', - 'search/get-started-with-search/search-basics/chart-search-results', - 'search/get-started-with-search/search-basics/comments-search-queries', - 'search/get-started-with-search/search-basics/export-search-results', - 'search/get-started-with-search/search-basics/pause-cancel-search', - 'search/get-started-with-search/search-basics/quick-search-collectors-sources', 'search/get-started-with-search/search-basics/reference-field-special-characters', - 'search/get-started-with-search/search-basics/save-search', - 'search/get-started-with-search/search-basics/search-autocomplete', - 'search/get-started-with-search/search-basics/search-large-messages', - 'search/get-started-with-search/search-basics/search-surrounding-messages', - 'search/get-started-with-search/search-basics/share-link-to-search', - 'search/get-started-with-search/search-basics/share-message-link', + 'search/get-started-with-search/search-page/wildcards-in-full-text-searches', 'search/get-started-with-search/search-basics/time-range-expressions', - 'search/get-started-with-search/search-basics/view-search-results-json-logs', - 'search/get-started-with-search/search-basics/view-traces-search-results', + 'search/get-started-with-search/search-basics/comments-search-queries', ], }, { type: 'category', - label: 'How to Use the Search Page', + label: 'Build Searches', + collapsible: true, + collapsed: true, + link: {type: 'doc', id: 'search/get-started-with-search/build-search/index'}, + items: [ + 'search/get-started-with-search/search-page/search-modes', + 'search/get-started-with-search/search-basics/search-autocomplete', + 'search/get-started-with-search/build-search/dynamic-parsing', + 'search/get-started-with-search/search-basics/quick-search-collectors-sources', + 'search/get-started-with-search/build-search/set-time-range', + 'search/get-started-with-search/build-search/use-receipt-time', + 'search/get-started-with-search/build-search/use-searchable-time', + 'search/get-started-with-search/build-search/use-url-to-run-search', + 'search/get-started-with-search/build-search/search-templates', + 'search/get-started-with-search/build-search/best-practices-search', + ], + }, + { + type: 'category', + label: 'Search Results', collapsible: true, collapsed: true, link: {type: 'doc', id: 'search/get-started-with-search/search-page/index'}, items: [ - 'search/get-started-with-search/search-page/add-saved-search-to-favorites', - 'search/get-started-with-search/search-page/pin-a-search', + 'search/get-started-with-search/search-page/navigate-through-search-results', + 'search/get-started-with-search/search-page/search-load-indicator', 'search/get-started-with-search/search-page/change-time-range-in-histogram', + 'search/get-started-with-search/search-page/search-highlighting', { type: 'category', label: 'Field Browser', @@ -1441,32 +1452,28 @@ module.exports = { ], }, 'search/get-started-with-search/search-page/log-level', - 'search/get-started-with-search/search-page/log-message-inspector', 'search/get-started-with-search/search-page/modify-search-from-messages-tab', - 'search/get-started-with-search/search-page/navigate-through-search-results', - 'search/get-started-with-search/search-page/search-highlighting', - 'search/get-started-with-search/search-page/search-load-indicator', - 'search/get-started-with-search/search-page/search-modes', + 'search/get-started-with-search/search-basics/search-surrounding-messages', + 'search/get-started-with-search/search-basics/search-large-messages', + 'search/get-started-with-search/search-basics/view-search-results-json-logs', + 'search/get-started-with-search/search-page/log-message-inspector', 'search/get-started-with-search/search-page/set-messages-tab-preferences', - 'search/get-started-with-search/search-page/wildcards-in-full-text-searches', + 'search/get-started-with-search/search-basics/chart-search-results', + 'search/get-started-with-search/search-basics/view-traces-search-results', + 'search/get-started-with-search/search-basics/export-search-results', ], }, { type: 'category', - label: 'Build Searches', + label: 'Manage Searches', collapsible: true, collapsed: true, - link: {type: 'doc', id: 'search/get-started-with-search/build-search/index'}, + link: {type: 'doc', id: 'search/get-started-with-search/manage-searches/index'}, items: [ - 'search/get-started-with-search/build-search/best-practices-search', - 'search/get-started-with-search/build-search/dynamic-parsing', - 'search/get-started-with-search/build-search/keyword-search-expressions', - 'search/get-started-with-search/build-search/search-syntax-overview', - 'search/get-started-with-search/build-search/search-templates', - 'search/get-started-with-search/build-search/set-time-range', - 'search/get-started-with-search/build-search/use-receipt-time', - 'search/get-started-with-search/build-search/use-searchable-time', - 'search/get-started-with-search/build-search/use-url-to-run-search', + 'search/get-started-with-search/search-basics/pause-cancel-search', + 'search/get-started-with-search/search-page/pin-a-search', + 'search/get-started-with-search/search-basics/save-search', + 'search/get-started-with-search/search-basics/share-link-to-search', ], }, { From 7abacebb0a2c9494aac1d4249337117b3ce31dc1 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 26 Aug 2026 00:34:34 -0700 Subject: [PATCH 2/4] DOCS-1829 - Clarify and align titles across Get Started with Search docs Sharpen titles so each doc makes sense out of context (e.g. as an Algolia search result), fix sentence-case heading violations, and update cross-references and index-page card text to match the new titles. Also fixes a few awkward or inaccurate sentences flagged during review (e.g. Search Modes' intro, which previously only described Basic Mode). Co-Authored-By: Claude Sonnet 5 --- docs/get-started/quickstart.md | 2 +- .../reliability-management-slo/create-slo.md | 4 +- .../reliability-management-slo/index.md | 2 +- .../build-search/best-practices-search.md | 7 +- .../keyword-search-expressions.md | 3 +- .../build-search/search-syntax.md | 6 +- .../build-search/search-templates.md | 2 +- .../build-search/use-receipt-time.md | 3 +- .../build-search/use-searchable-time.md | 22 +++--- .../search-basics/about-search-basics.md | 15 ++-- .../search-basics/built-in-metadata.md | 79 +++++++++++++------ .../search-basics/chart-search-results.md | 8 +- .../search-basics/comments-search-queries.md | 16 ++-- .../search-basics/export-search-results.md | 5 +- .../search-basics/pause-cancel-search.md | 8 +- .../quick-search-collectors-sources.md | 10 +-- .../reference-field-special-characters.md | 7 +- .../search-basics/search-autocomplete.md | 5 +- .../search-basics/search-large-messages.md | 6 +- .../search-surrounding-messages.md | 5 +- .../search-basics/time-range-expressions.md | 5 +- .../view-traces-search-results.md | 4 +- .../search-page/log-level.md | 7 +- .../search-page/log-message-inspector.md | 7 +- .../modify-search-from-messages-tab.md | 2 +- .../navigate-through-search-results.md | 2 +- .../search-page/pin-a-search.md | 3 +- .../search-page/search-highlighting.md | 2 +- .../search-page/search-modes.md | 37 +++++---- .../set-messages-tab-preferences.md | 2 +- .../wildcards-in-full-text-searches.md | 2 +- .../apache-access-parser.md | 16 ++-- .../apache-errors-parser.md | 14 ++-- .../suggested-searches/cisco-asa-parser.md | 10 +-- .../suggested-searches/index.md | 7 +- .../microsoft-iis-parser.md | 8 +- .../suggested-searches/windows-events.md | 8 +- 37 files changed, 199 insertions(+), 152 deletions(-) diff --git a/docs/get-started/quickstart.md b/docs/get-started/quickstart.md index 13d0d72b4ae..0e0d21eab99 100644 --- a/docs/get-started/quickstart.md +++ b/docs/get-started/quickstart.md @@ -126,7 +126,7 @@ See [Sumo Logic OpenTelemetry Collector](/docs/send-data/opentelemetry-collector Once your data is available in Sumo, you and your colleagues can search your logs and metrics to identify unusual conditions or errors that could indicate a problem. You do this by creating queries and parsing the resulting messages. -You can start a log search, metrics search, or live tail from the Sumo Home page by clicking the respective icon. For walkthrough instructions on how to create a query and parse the messages, see [About Search Basics](/docs/search/get-started-with-search/search-basics/about-search-basics/). +You can start a log search, metrics search, or live tail from the Sumo Home page by clicking the respective icon. For walkthrough instructions on how to create a query and parse the messages, see [How Sumo Logic Search Query Syntax Works](/docs/search/get-started-with-search/search-basics/about-search-basics/). ## Step 3: Monitor and troubleshoot your environment diff --git a/docs/observability/reliability-management-slo/create-slo.md b/docs/observability/reliability-management-slo/create-slo.md index e9f363c093b..4a09995d2dd 100644 --- a/docs/observability/reliability-management-slo/create-slo.md +++ b/docs/observability/reliability-management-slo/create-slo.md @@ -86,11 +86,11 @@ You can use Terraform to manage SLOs with the [`sumologic_slo`](https://registry For Ratio-based definitions, which calculate successful or unsuccessful events against total events:
  1. Specify Total Events query.
    2. -
  2. Search logs selecting and entering a log query. See [About Search Basics](/docs/search/get-started-with-search/search-basics/about-search-basics) for more information.
    3. +
  3. Search logs selecting and entering a log query. See [How Sumo Logic Search Query Syntax Works](/docs/search/get-started-with-search/search-basics/about-search-basics) for more information.
  4. For Use values from, select the numeric value available for that query to pull data from.
  5. Then configure the Total Events, including a query and values. You can copy and paste the previous query, perhaps with filters removed to get the total.
For Threshold-based definitions, which calculate against success criteria:
  1. Select Successful or Unsuccessful Events to measure.
    2. -
  2. Search logs selecting and entering a log query. See [About Search Basics](/docs/search/get-started-with-search/search-basics/about-search-basics) for more information.
    3. +
  3. Search logs selecting and entering a log query. See [How Sumo Logic Search Query Syntax Works](/docs/search/get-started-with-search/search-basics/about-search-basics) for more information.
  4. For Use values from, it always uses the Metric value.
  5. For Success Criteria for Avg, Min, Max, or Sum of the selected signal type (such as latency), which must be greater than, greater than or equal to, less than, or less than equal to an amount you enter (positive or negative number).
diff --git a/docs/observability/reliability-management-slo/index.md b/docs/observability/reliability-management-slo/index.md index 01105e8e7d9..7908772093e 100644 --- a/docs/observability/reliability-management-slo/index.md +++ b/docs/observability/reliability-management-slo/index.md @@ -160,7 +160,7 @@ The heart of an SLO is the queries used for the SLI query types, including metri #### General information -For general information on querying metrics and logs, see [Introduction to Metrics](/docs/metrics/introduction) and [About Search Basics](/docs/search/get-started-with-search/search-basics/about-search-basics). +For general information on querying metrics and logs, see [Introduction to Metrics](/docs/metrics/introduction) and [How Sumo Logic Search Query Syntax Works](/docs/search/get-started-with-search/search-basics/about-search-basics). A preview runs the query in real-time to help test and refine results, with a time range to see broader results as needed. diff --git a/docs/search/get-started-with-search/build-search/best-practices-search.md b/docs/search/get-started-with-search/build-search/best-practices-search.md index 3cffc5893da..8bc1acbf4c9 100644 --- a/docs/search/get-started-with-search/build-search/best-practices-search.md +++ b/docs/search/get-started-with-search/build-search/best-practices-search.md @@ -1,6 +1,7 @@ --- id: best-practices-search -title: Best Practices for Searches +title: Best Practices for Log Search +sidebar_label: Best Practices description: Use these easy to follow rules to get the most out of your Sumo Logic searches. --- @@ -8,7 +9,7 @@ Use these easy-to-follow rules to get the most out of your Sumo Logic searches. ## Be specific with search scope -At a minimum, all searches should use one or more [metadata](../search-basics/built-in-metadata.md) tags in the scope, for example:  `_sourceCategory`, `_source`, `_sourceName`, `_sourceHost`, or `_collector`. +At a minimum, all searches should use one or more [metadata](../search-basics/built-in-metadata.md) tags in the scope, for example: `_sourceCategory`, `_source`, `_sourceName`, `_sourceHost`, or `_collector`. If possible, also use one or more keywords to limit the scope. @@ -89,7 +90,7 @@ If you need to use parse regex, avoid the use of expensive operations like `.*`. Sumo provides two index-based search optimization features: partitions and scheduled views. When you run a search against an partition or scheduled view, search results are returned more quickly and efficiently because the search is run against a smaller data set. For more information, see [Optimize Search Performance](../../optimize-search-performance.md). -## Use Search Parameters +## Use search parameters If your search contains filtering criteria that could change each time the search is executed, take advantage of [Search Templates](search-templates.md). Search templates make it easier for less expert users to obtain search results, and also reduces the risk that such users will run expensive searches. diff --git a/docs/search/get-started-with-search/build-search/keyword-search-expressions.md b/docs/search/get-started-with-search/build-search/keyword-search-expressions.md index 0f3786f8f80..ea25e6e8e8d 100644 --- a/docs/search/get-started-with-search/build-search/keyword-search-expressions.md +++ b/docs/search/get-started-with-search/build-search/keyword-search-expressions.md @@ -1,6 +1,7 @@ --- id: keyword-search-expressions -title: Keyword Search Expressions +title: Define the Scope of a Query with Keyword Search Expressions +sidebar_label: Keyword Search Expressions description: The text that comes before the first pipe symbol in a query is called the keyword expression or scope. --- diff --git a/docs/search/get-started-with-search/build-search/search-syntax.md b/docs/search/get-started-with-search/build-search/search-syntax.md index eb907c8beff..f12955c2fc1 100644 --- a/docs/search/get-started-with-search/build-search/search-syntax.md +++ b/docs/search/get-started-with-search/build-search/search-syntax.md @@ -13,7 +13,7 @@ The Sumo Logic Search Language operates on your entire log repository, no matter * A query is limited to a maximum of 15,000 characters. * A word is limited to a maximum of 2,300 characters. -## Query Syntax +## Query syntax The basis of Sumo Logic Search is a funnel or "pipeline" concept: beginning from all of your current Sumo Logic data, you enter keywords and operators separated by pipes (`|`). Each operator acts on the results from the previous operator to further process your results. Results are returned incrementally with the most recent messages displaying first. Additional messages are added progressively to the Messages tab as the search walks backward in time through all of your log data. @@ -29,7 +29,7 @@ Keyword expressions are often referred to as the **scope** of a query. **Operators**. After filtering with an initial full-text search, the operators that follow can parse data into fields, refine results using conditional expressions, and then aggregate and organize results. -## Pipe "|" Delimiter +## Pipe "|" delimiter The pipe delimiter is used to separate the keyword expression and each subsequent operator. Each pipe-delimited operator further processes search results from the preceding operator. You can use some operators together within a single pipe (like **sum** and **avg**), but they are processed by the specified fields together. @@ -42,7 +42,7 @@ The pipe delimiter is used to separate the keyword expression and each subsequen Query syntax -## User-Parsed Fields +## User-parsed fields You can parse or extract values and assign them to an alias, known as a field, to the result. The field is valid only for the current search and does not carry over to new searches. When creating fields, there are a few rules that apply: diff --git a/docs/search/get-started-with-search/build-search/search-templates.md b/docs/search/get-started-with-search/build-search/search-templates.md index d123ce07f04..4de9e339bf6 100644 --- a/docs/search/get-started-with-search/build-search/search-templates.md +++ b/docs/search/get-started-with-search/build-search/search-templates.md @@ -147,7 +147,7 @@ If you want to delete a search template, delete the existing parameters. When yo When you delete a String parameter, the default value is substituted back into the query in double-quotes. For example “user_name”. If you did not specify a default value for this parameter, you must specify one now before re-running the query. You may also need to remove the quotes. -## Best Practices +## Best practices The important thing to remember when using search templates is to carefully consider which parameters in your queries users need to change most. diff --git a/docs/search/get-started-with-search/build-search/use-receipt-time.md b/docs/search/get-started-with-search/build-search/use-receipt-time.md index 3e6463af9d6..e97d88d2a1c 100644 --- a/docs/search/get-started-with-search/build-search/use-receipt-time.md +++ b/docs/search/get-started-with-search/build-search/use-receipt-time.md @@ -1,6 +1,7 @@ --- id: use-receipt-time -title: Use Receipt Time +title: Run a Search Using Receipt Time Instead of Message Time +sidebar_label: Use Receipt Time description: Enable the Use Receipt Time feature to display search results in the order that the Collector received the messages in milliseconds. --- diff --git a/docs/search/get-started-with-search/build-search/use-searchable-time.md b/docs/search/get-started-with-search/build-search/use-searchable-time.md index 1f6144c74be..c873ea01c09 100644 --- a/docs/search/get-started-with-search/build-search/use-searchable-time.md +++ b/docs/search/get-started-with-search/build-search/use-searchable-time.md @@ -1,6 +1,6 @@ --- id: use-searchable-time -title: Use Searchable Time +title: Run a Search Using Searchable Time to Avoid Ingestion Gaps sidebar_label: Use Searchable Time description: You can display search results in the order when the logs become available for search. --- @@ -13,10 +13,6 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This resolves the inconsistent error messages due to variable ingestion latency and non-linear receipt time indexing issues by marking the time only when the data is truly searchable. This ensures running queries with non-overlapping but exhaustive time ranges will prevent any gaps or duplication in the data. -:::info -Currently, **Searchable Time** is only available for the Log Search UI page, Scheduled Searches, Saved Searches, Dashboards, Monitors, and Search Job API queries. -::: - ## Via UI ### Run a search using Searchable Time @@ -35,15 +31,15 @@ Follow the below steps to run a scheduled search by searchable time: 1. Enter your query in the search text box and click **Save As..**. 1. In the **Save Item** pop-up, select **Searchable Time** from the timestamp dropdown.
Searchable time scheduled search -### Create a dashboard using Searchable Time +### Create a dashboard using Searchable Time :::note -**Searchbale Time** will not be available for *Metrics* or *Spans* query. +**Searchable Time** will not be available for *Metrics* or *Spans* query. ::: Follow the below steps to run a search using the searchable time in the dashboard: -1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Dashboards > New Dashboard**. You can also click the **Go To...** menu at the top of the screen and select **New Dashboard**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Go to the **Home** screen and select **Dashboard**. +1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Dashboards > New Dashboard**. You can also click the **Go To...** menu at the top of the screen and select **New Dashboard**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Go to the **Home** screen and select **Dashboard**. 1. Select a panel type by clicking the corresponding icon.
panel types 1. You are prompted to provide a log query. 1. Navigate to **General** configuration. @@ -58,9 +54,9 @@ When you [create a monitor](/docs/alerts/monitors/create-monitor#timestamp), you ### Run a search by Searchable Time using Search Job API To create a search, refer to the [Search Job API Documentation](/docs/api/search-job/#create-a-search-job). Below mentioned parameter has been updated due to addition of searchable time feature: - + | Parameter | Type | Required | Description | -| :-- | :-- | :-- | :-- | +| :-- | :-- | :-- | :-- | | `intervalTimeType` | String | Yes | This parameter defines whether you want to run the search by messageTime, receiptTime, or searchableTime. By default, the search will run by messageTime. | :::note @@ -72,7 +68,7 @@ If both `runByReceiptTime` and `intervalTimeType` parameters are present then th To create a dashboard, refer to the [Search Job API Documentation](/docs/api/dashboard/). Below mentioned parameter has been updated due to addition of searchable time feature: | Parameter | Type | Required | Description | -| :-- | :-- | :-- | :-- | +| :-- | :-- | :-- | :-- | | `timeSource` | String | Yes | This parameter defines the time source of the query. Possible values are `Message`, `Receipt`, or `Searchable`. By default, `Message` will be used as the time source.
**Message**. Uses the timestamp on the message.
**Receipt**. Timestamp when the logs were received by Sumo Logic.
**Searchable**. Timestamp when the logs are available for search. | :::info @@ -81,4 +77,6 @@ To create a dashboard, refer to the [Search Job API Documentation](/docs/api/das ## Limitations -- Subqueries are not supported for Searchable Time. +Currently, **Searchable Time** is only available for the Log Search UI page, Scheduled Searches, Saved Searches, Dashboards, Monitors, and Search Job API queries. + +Subqueries are not supported for Searchable Time. diff --git a/docs/search/get-started-with-search/search-basics/about-search-basics.md b/docs/search/get-started-with-search/search-basics/about-search-basics.md index 7529b7da9a2..02747fd3621 100644 --- a/docs/search/get-started-with-search/search-basics/about-search-basics.md +++ b/docs/search/get-started-with-search/search-basics/about-search-basics.md @@ -1,23 +1,24 @@ --- id: about-search-basics -title: About Search Basics +title: How Sumo Logic Search Query Syntax Works +sidebar_label: About Search Basics description: Sumo Logic search syntax is based on a funnel or "pipeline" concept and it uses logical and familiar operators letting you to create ad hoc queries quickly. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -Our Search Syntax is based on a funnel or "pipeline" concept. The wide mouth of the funnel begins with all your current Sumo Logic data, and you narrow the funnel by entering keywords and operators separated by pipes (`|`). Each operator acts on the results from the previous operator so that you can progressively filter and pinpoint your search until you find exactly what you’re looking for. +Sumo Logic search syntax is based on a funnel or "pipeline" concept. The wide mouth of the funnel begins with all your current Sumo Logic data, and you narrow the funnel by entering keywords and operators separated by pipes (`|`). Each operator acts on the results from the previous operator so that you can progressively filter and pinpoint your search until you find exactly what you’re looking for. import Iframe from 'react-iframe'; :::training Micro Lesson -How to search data using the Basic Search Mode in Sumo Logic. +How to search data using the Basic Mode Search in Sumo Logic.