Sumo's equivalent of Splunk makeresults?
Splunk has makeresults functionality using it I can insert dummy data for the test. Is there any Sumo's equivalent of Splunk's makeresults?
-
Official comment
Hi Utsav,
One way you can do this is to overwrite the _raw value with a string that you can specify.
*
| limit 1
| "Vegemite is better than Marmite" as _rawThis would overwrite the original value with the double-quoted text you specify.
Another way to do this would be to take advantage of the event-duplication behaviour of parse regex multi as follows:
*
| limit 1
| "Apple Banana Carrot Doughnut Easter" as _raw
| parse regex "(?<_raw>\w+)" multiWhich would give you 5 "events" each with a unique value for the record.
It's important to note that your environment must have at least 1 event in the timeframe you have specified for this to work (however you can use internal audit records in this way as well).
I hope this helps :-)
Comment actions -
That's correct - the operation is run time only and does not ingest any data. If you require "dummy" data to be ingested, I'd suggest using the Collection > Setup Wizard > Upload Data facility. I'd recommend using a unique Source Category value for this data (e.g. "dummy/app1") to ensure the data you upload does not unintentionally match any saved searches by other users in your environment.
Please sign in to leave a comment.
Comments
4 comments