Data Management
Collectors
- How do Sumo Logic store access tokens for collecting Office 365 logs?
- How can I update a collector name after installing a collector?
- High Collector CPU Use After Leap Second
- How to remove HPROF dump files (java_pid*) inside collector installation folder utilising disk space?
- While running Sumojanus script for SalesForce log collection, I get error "An illegal reflective access operation has occurred". Why is it so?
- ALB/ELB multiple log lines are being concatenated as single line. What could be causing this and how to resolve it?
Sources
- * ERROR: Registration failed: Invalid source: * The json file C:\Scripts\Sumologic\source.json contains invalid value.
- Collector refuse to remove sources from sources.json (Local file Management Mode) due to multiple filters supplied with the same "Name" key.
- Remote Windows Event Log source fails to connect to the event channel
- Experiencing ingestion issues for G-Suite Apps Audit sources
- Data ingested from an S3 bucket or an HTTP source consumes more storage in Sumo Logic
- How can I ingest Microsoft Teams logs in to Sumologic?
Data Forwarding
- Is there a way to forward the parsed fields used in the scheduled views via Data Forwarding in Sumo Logic?
- When forwarding data to S3, are the logs sent before or after processing rules have been applied?
- If I create a Scheduled View with a start date in the past and data forwarding enabled, how will the data be forwarded?
- Error when creating S3 Data Forwarding: Unable to initiate S3 object uploads
- Data is not Forwarding from Sumo Logic to our S3 Bucket
- Collector Warning message: Unable to forward message to <ip address>-<Port>
Field Extraction Rules
Scheduled Views/Partitions
- Is there any extra data cost when using Partition/Scheduled View?
- Search query does not produce results for frequent tier partition.
- Does SumoLogic use receipt time or message time for calculating data retention?
- If we use the Save To Index feature for alerting, what is the retention period for the same index?
- When I use Save to Index, metadata fields from the Collector (for example, _collector) will be dropped. Does that mean the data in the index will not have any associated metadata?