As per the current functionality Sumo Logic cannot forward parsed fields from your queries.
We can only forward the raw logs that your Scheduled View returns, along with the metadata.
We have the only fields that we send documented here: doc
So typically the current data forwarding is meant for exporting raw data out of Sumo Logic for Audit, compliance or archival purposes, therefore Sumo Logic doesn't support exporting the parsed out fields.
For exporting both meta-data and user-defined fields Sumo Logic has provided access to the Search Job API, which can be used for those types of use-cases.
Comments
0 comments
Please sign in to leave a comment.