Kevin Keech2
- Total activity 300
- Last activity
- Member since
- Following 0 users
- Followed by 0 users
- Votes 0
- Subscriptions 88
Activity overview
Latest activity by Kevin Keech2-
Kevin Keech2 commented,
Agree with using parse regex / multi. Here is another example that captures the file name as well as the size. | parse regex "(?:\[|,\s+)(?<name>.*?)\(size=(?<size>\d+)\)" multi When using the Mul...
-
Kevin Keech2 commented,
Good to see you got things working. So your account is in the Sumo Logic "US1" deployment, which does not have a specific deployment ID within the URLs. This is also why you and others don't see th...
-
Kevin Keech2 commented,
There are a few things that could lead to authentication issues that you will want to check. 1.) The user who generated the AccessKey/ID has the permissions to Manage Collectors2.) The proper deplo...
-
Kevin Keech2 commented,
When you say you want to search, do you just want to return messages where the parsed field includes a specific string? If so then you can use a "matches" operation within a "where" statement like ...
-
Kevin Keech2 commented,
Hi Rizwan, You will need to generate the AccessID and Key from within your Sumo Logic account, under your user preferences page. The following help documentation should assist with the process. htt...
-
Kevin Keech2 commented,
There are a few ways you can parse this. (Note: I am assuming you want the name to the left of the epoch timestamp in the message) 1.) Since the logs are pipe-delimited you can use the "split" oper...
-
Kevin Keech2 commented,
H James, This is possible and there may be a couple of ways to do this. First would be using a subquery. Example: _sourcecategory=<transmission_sent>| parse "id: *" as id| where !( [subquery:_sour...
-
Kevin Keech2 commented,
Awesome. I noticed I had a small error in the field label for the "finished" field and have fixed that in my original post.
-
Kevin Keech2 commented,
Keywords are not case sensitive; however, the matching operators will be case sensitive. When you say you add "error or Error" are you putting that literally in your query keywords like below?_coll...
-
Kevin Keech2 commented,
Changing the name of the Collector or a Source should not affect the collection of logs, but it will change the metadata assigned to any logs received so you will need to make sure and change any q...