Comments

4 comments

  • Avatar
    Rick Jury

    Hi Patricia,

    I'm not 100% clear about what you are wanting here so apologies if any of these are off the mark.

     

    here are some suggestions:

    1. in the query time picker you can use relative times for example "-28d" will translate to 4 weeks ago to now.

    2. for long rang aggregation the scheduled view is a great option. For this you would:

    a) make a scheduled view to aggregate your results with say timeslice 1d.

    b) run your query vs the _view.

    This would enable you to run very fast aggregate queries over long time ranges.

    3. for the actual query there is an accum operator you can use to show a cumulative total over time. https://help.sumologic.com/Metrics/Metric-Queries-and-Alerts/03Metrics_Operators/accum

    0
    Comment actions Permalink
  • Avatar
    Rick Jury

    here is the other link forgot to include sorry: https://help.sumologic.com/Manage/Scheduled-Views

    0
    Comment actions Permalink
  • Avatar
    Patricia Lavin

    Thanks Rick for your reply. What we're looking to do is create a master export of our logged data so that over time we can see the usage and trends. Ideally we would just replace the master export/spreadsheet with each subsequent day/week accumulation of information but I'm not sure that this is possible, and we'd have to manually amend the spreadsheet with the new data to be able to track the data over time.

    So, say we started tracking today (31st March), then next week we'd have a scheduled view with the first week of data. Then the following week the scheduled view would have two weeks of data, then three weeks of data and so on.

    0
    Comment actions Permalink
  • Avatar
    Rick Jury

    right. are you talking about summarizing the ingest using the data volume index? That is how many sumo customers have created a long term summary view of ingestion by say _sourcecategory or _collector. 

    When you create a view you can also backfill it into the past so you can get a historical view.

    There are ways to to setup your own custom view of ingestion size too using scheduled views.

    If you contact your Sumo account manager or Customer Success Manager they can put you in touch with someone to help you set this up in your account. 

     

    0
    Comment actions Permalink

Please sign in to leave a comment.