Rick Jury
Customer Success Engineer, APAC at Sumo Logic
- Total activity 100
- Last activity
- Member since
- Following 0 users
- Followed by 2 users
- Votes 0
- Subscriptions 49
Activity overview
Latest activity by Rick Jury-
Rick Jury commented,
if you run the subquery without the subquery but just compose you will see what is going on. for exampleerror | count by _sourcecategory | compose _sourcecategory vs error | count by _sourcecatego...
-
Rick Jury commented,
in order to do a transaction type use case you need to define the id field with the same name in both then use one of the sumo transaction operators (such as transactionize ... merge ...) or just d...
-
Rick Jury commented,
Official comment hi Austin, the values operator will likely save the day here as it will merge all possible values into one field using one more aggregate fields. If there are only two options: null or a value A y...
-
Rick Jury commented,
hi Ken, try putting the verbose switch on the end. this will show errors for example if your authentication is invalid. New-SumoSession -AccessId $env:SUMO_ACCESS_ID -AccessKeyAsSecureString $acce...
-
Rick Jury commented,
try the collection link in the app docs page: https://help.sumologic.com/07Sumo-Logic-Apps/08App_Development/GitHub
-
Rick Jury commented,
Official comment Hi Pamela, you can easily export a list of all collectors and their versions via the collectors API. This repo is a good example of a python utility to list versions and trigger bulk upgrade jobs. ...
-
Rick Jury commented,
Official comment Hi Juan, you can use a processing rule https://help.sumologic.com/Manage/Collection/Processing-Rules/Include-and-Exclude-Rules say an exclude rule on your ingestion source of ^START RequestId.*
-
Rick Jury commented,
Official comment Hi dominic, the usual approach here is to use transpose e.g | count by _timeslice,status_code| transpose row _timeslice column status_code
-
Rick Jury commented,
Official comment Hi Scott, each event has a two built in timestamps that are epoctime ms values _receipttime and _messagetime so you can do something like this:_sourceCategory=apache_access| parse regex "(?<ip_add...
-
Rick Jury commented,
It might be better to contact your sumo Customer success team about this one. It looks like a complex query that would need access to the source data and more info about your use case.You can run d...