Convert splunk query to Sumo logic


1 comment

  • Avatar
    Jorge Silva

    Hello Mani,

    The first line in your query would be the metadata that references the data in Sumo Logic followed by the same keywords you are using. 

    For the second line, it looks like you are pre-parsing that data in Splunk using a feature similar to Field Extraction Rules in Sumo Logic. If you are not pre-parsing this data in Sumo Logic using FERs, then you will have to manually parse it in the query. You can read more about parsing operators at

    I'm not sure about the rest of your query. It would be best if you open a support ticket with Sumo Logic and explain what this query does and provide an output example in Splunk (Screenshot). This would help us help you in translating this query. To open a ticket with Support, please go to or email For more information about contacting support, please go to

    Best regards,


    Comment actions Permalink

Please sign in to leave a comment.