Kevin Keech
- Total activity 237
- Last activity
- Member since
- Following 0 users
- Followed by 0 users
- Votes 0
- Subscriptions 66
Activity overview
Latest activity by Kevin Keech-
Kevin Keech commented,
You will need to first parse the strings from your messages into a field and from there perform a count operation against the values found in that field. For example, given the following example me...
-
Kevin Keech commented,
Hi Lance, Lookaheads should work within the processing rules. The below expression. (username(?=@domain)) With a mask string of xxxx, should change username@domain to xxxx@domain. I tried this out...
-
Kevin Keech commented,
The multi-option should generate a new row for each value matched by the regular expression. So for example, if you have just 1 JSON message with 5 IDs and you perform a multi parse you will end up...
-
Kevin Keech commented,
Hi Wilson, This entry in the user.properties file is currently expected and normal and does not mean there is, or has been, an error with your Collector. This property is added automatically at ins...
-
Kevin Keech commented,
Assuming you want the 95th percentile of the count per url the following should get that result. | parse "url=*" as url | timeslice by 1m| count by _timeslice, url| pct(_count, 95) by url
-
Kevin Keech commented,
The following query should help give you what you are looking for and does not require a subquery operation. _sourceName = abc | parse "msgid= *" as msgId| timeslice 1h | count by msgId, _timeslic...
-
Kevin Keech commented,
Only if the logs from that microservice were specifically sent to its own Partition. Deletion can only be applied to a given time range and index (ie Partition/View) and deletion will delete all me...
-
Kevin Keech commented,
Hi Aric, Sumo Logic assumes that all log messages coming from a particular Source will have timestamps that are within a window of -1 year through +2 days compared to the current time. Any log mess...
-
Kevin Keech commented,
Hi Joe, What type of edits are you thinking of? Sumo Logic allows you to mask or hash data from your logs prior to indexing. Sumo Logic also allows you to filter messages from being sent via Includ...
-
Kevin Keech commented,
This is something that would need to be configured within IIS, not within Sumo Logic. You would need to configure IIS to post this information into its logs so it can then be picked up by your Coll...