if then logic or multiple searches

Comments

1 comment

  • Avatar
    Jorge Silva

    Hello Patrick,

    1. would this be the best approach for this?  I'm a little worried that I would get an email blast of a few emails with different kinds of blocks with individual alerts.

    You can set up separate alerts or combine them all into a single search. Whichever way works best for you. If you combined them all you should not be receiving an email blast of a few emails with different kinds of blocks. You will only get a single email every time the condition of the search is met. 

    2. I'm stuck also.  I'm not a developer by trade and I can't figure out how to get each alert into it's own separate message from here.  I know i'm close but as far as I'm aware there is no "if/then" in sumo.

    The Sumo Logic "IF" operator can do an if-else operation. Looking at your query, it is read as if "Wait_Type" matches "LCK_M_X" then value if true equals "1" else value if false = "0"

    You can also combine your "IF" statements into a nested one. For more information about this, please go to https://help.sumologic.com/05Search/Search-Query-Language/Search-Operators/if-operator-and.

    If you would like assistance building your query, then please open a ticket with support by going to support.sumologic.com or emailing support@sumologic.com.

    0
    Comment actions Permalink

Please sign in to leave a comment.