Matt
- Total activity 83
- Last activity
- Member since
- Following 0 users
- Followed by 0 users
- Votes 0
- Subscriptions 44
Activity overview
Latest activity by Matt-
Matt commented,
Official comment Hi Sundar, It will be difficult without seeing more context to provide a precise query for this one. Some questions I would have: Are there jobs besides ABB that need to be handled? Statuses beyon...
-
Matt commented,
Official comment If you own the python code, I would just start the iterator with 1 instead of 0 index to start things at line 2. Or if using for x in list pattern, filter out there. If that's infeasible, yes, you ...
-
Matt commented,
Official comment If your sourcecategory has such a predictable pattern, I would avoid regex entirely and just use this: | split _sourcecategory delim='/' extract 1 as part1, 2 as part2, 3 as part3, 4 as part4 if ...
-
Matt commented,
Official comment Hi Justin, Sorry for the delay, hope this is still useful. Dashboard panels can only be made from queries that use aggregate operators. Below would I think do what you require: // your query scope...
-
Matt commented,
Official comment sorry for delay. this might be a good use case for a subquery. the child query could determine whether or not you care to see the raw messages in that same 10m timewindow. if you don't need the raw...
-
Matt commented,
Hi Jacob, I note that a more recent check-in to the Docker collector does add support for Prometheus format See https://github.com/SumoLogic/sumologic-collector-docker/releases/tag/v19.227-19 The i...
-
Matt commented,
Official comment once you've done the aggregation pct call, the duration is indeed dropped. You might consider splitting this into two queries. First query could be run as a scheduled search to save off the 95th pe...
-
Matt commented,
A version that does counts as well as %, as I just realized that was desired: _sourceCategory=CategoryICareAbout| count as occurrences by event_id | total(occurrences) as totaloccurrences| sort occ...
-
Matt commented,
hopefully no one used the first version I posted above. Just edited to replace the 2nd to last line as follows: | if ((_accum=6), remainingpercent+percent, percent) as percent
-
Matt commented,
Official comment try this out, not sure if it's the most efficient way, but worked for me, of course using a different source category matching our test data. _sourceCategory=CategoryICareAbout| count event_id | to...