Create Alert when new collector got added.
Hi Team,
I am very new to sumologic and started learning stuff but now I have the below query,
We have managed the service and it's running in AWS. When a customer created a service it uses AMI Image with all pre-set configurations(includes sumologic). New service is automated added to the sumologic collector and we will get a notification if any Load Balancer or Disk Full issue.
Now my query on Sumologic, How I create an alert when a new collector is added automatically.
-
Hello Ajith Kumar,
Please find the below query to track New Collector creation:
_index=sumologic_audit_events AND _sourceCategory=collection AND "CollectorCreated"
| json "eventName", "eventTime", "operator.email", "operator.id", "operator.sourceIp", "operator.interface", "collectorIdentity.collectorName", "collector.ephemeral", "collector.sourceSyncMode", "collector.collectorType", "to", "from" as EventName, EventTime, UserEmail, UserId, UserIp, Interface, CollectorName, IsEphemeral, SourceSyncMode, CollectorType, CurrentValue, PreviousValue nodrop
| where EventName ="CollectorCreated"
| count by EventName, EventTime, CollectorName, IsEphemeral, SourceSyncMode, CollectorType, Interface, UserEmail, UserId, UserIp
| fields -_countWe also recommend you to check our Enterprise Audit App:
Thank you
Regards
Harishwer Selvakumar
Customer Success Engineer - Sumo Logic
Please sign in to leave a comment.
Comments
2 comments