Matt Sullivan
- Total activity 81
- Last activity
- Member since
- Following 0 users
- Followed by 0 users
- Votes 0
- Subscriptions 43
Activity overview
Latest activity by Matt Sullivan-
Matt Sullivan commented,
Official comment If you own the python code, I would just start the iterator with 1 instead of 0 index to start things at line 2. Or if using for x in list pattern, filter out there. If that's infeasible, yes, you ...
-
Matt Sullivan commented,
Official comment If your sourcecategory has such a predictable pattern, I would avoid regex entirely and just use this: | split _sourcecategory delim='/' extract 1 as part1, 2 as part2, 3 as part3, 4 as part4 if ...
-
Matt Sullivan commented,
Official comment Hi Justin, Sorry for the delay, hope this is still useful. Dashboard panels can only be made from queries that use aggregate operators. Below would I think do what you require: // your query scope...
-
Matt Sullivan commented,
Official comment sorry for delay. this might be a good use case for a subquery. the child query could determine whether or not you care to see the raw messages in that same 10m timewindow. if you don't need the raw...
-
Matt Sullivan commented,
Hi Jacob, I note that a more recent check-in to the Docker collector does add support for Prometheus format See https://github.com/SumoLogic/sumologic-collector-docker/releases/tag/v19.227-19 The i...
-
Matt Sullivan commented,
Official comment once you've done the aggregation pct call, the duration is indeed dropped. You might consider splitting this into two queries. First query could be run as a scheduled search to save off the 95th pe...
-
Matt Sullivan commented,
A version that does counts as well as %, as I just realized that was desired: _sourceCategory=CategoryICareAbout| count as occurrences by event_id | total(occurrences) as totaloccurrences| sort occ...
-
Matt Sullivan commented,
hopefully no one used the first version I posted above. Just edited to replace the 2nd to last line as follows: | if ((_accum=6), remainingpercent+percent, percent) as percent
-
Matt Sullivan commented,
Official comment try this out, not sure if it's the most efficient way, but worked for me, of course using a different source category matching our test data. _sourceCategory=CategoryICareAbout| count event_id | to...
-
Matt Sullivan commented,
Official comment Looks as if this has gone a while without an answer. Apologies for the delay. I'm not 100% sure I'm following the question but will take a stab. Sumo Logic doesn't need to understand what you write...