Matt Sullivan
- Total activity 83
- Last activity
- Member since
- Following 0 users
- Followed by 0 users
- Votes 0
- Subscriptions 44
Activity overview
Latest activity by Matt Sullivan-
Matt Sullivan commented,
Official comment Hi Sundar, It will be difficult without seeing more context to provide a precise query for this one. Some questions I would have: Are there jobs besides ABB that need to be handled? Statuses beyon...
-
Matt Sullivan commented,
Official comment If you own the python code, I would just start the iterator with 1 instead of 0 index to start things at line 2. Or if using for x in list pattern, filter out there. If that's infeasible, yes, you ...
-
Matt Sullivan commented,
Official comment If your sourcecategory has such a predictable pattern, I would avoid regex entirely and just use this: | split _sourcecategory delim='/' extract 1 as part1, 2 as part2, 3 as part3, 4 as part4 if ...
-
Matt Sullivan commented,
Official comment Hi Justin, Sorry for the delay, hope this is still useful. Dashboard panels can only be made from queries that use aggregate operators. Below would I think do what you require: // your query scope...
-
Matt Sullivan commented,
Official comment sorry for delay. this might be a good use case for a subquery. the child query could determine whether or not you care to see the raw messages in that same 10m timewindow. if you don't need the raw...
-
Matt Sullivan commented,
Hi Jacob, I note that a more recent check-in to the Docker collector does add support for Prometheus format See https://github.com/SumoLogic/sumologic-collector-docker/releases/tag/v19.227-19 The i...
-
Matt Sullivan commented,
Official comment once you've done the aggregation pct call, the duration is indeed dropped. You might consider splitting this into two queries. First query could be run as a scheduled search to save off the 95th pe...
-
Matt Sullivan commented,
A version that does counts as well as %, as I just realized that was desired: _sourceCategory=CategoryICareAbout| count as occurrences by event_id | total(occurrences) as totaloccurrences| sort occ...
-
Matt Sullivan commented,
hopefully no one used the first version I posted above. Just edited to replace the 2nd to last line as follows: | if ((_accum=6), remainingpercent+percent, percent) as percent
-
Matt Sullivan commented,
Official comment try this out, not sure if it's the most efficient way, but worked for me, of course using a different source category matching our test data. _sourceCategory=CategoryICareAbout| count event_id | to...