Graham Watts
- Total activity 117
- Last activity
- Member since
- Following 0 users
- Followed by 1 user
- Votes 0
- Subscriptions 69
Activity overview
Latest activity by Graham Watts-
Graham Watts commented,
Official comment Hi Tim,I am confirming with my alerting Product Manager but I believe using _receiptTime for Logs Monitors is not yet supported. You may need to use Scheduled Searches for this.Also, which source t...
-
Graham Watts commented,
Happy to help Aaron, I am a fan of doing it all in one search if possible!
-
Graham Watts commented,
Official comment Hi Chris,On method for sampling results in a query is parsing out the timestamp. You can use parse regex, for example, to parse the number for hours, minutes, and seconds.If you have a timestamp wi...
-
Graham Watts commented,
Official comment Hi Arron,It's hard to confirm without testing but Yit seems like you may be able to use the accum and total operators here, can you try this approach?_sourceCatagory=test _sourceName=test| parse ip...
-
Graham Watts commented,
Official comment Hi Nagaraju,For this use case, you should use a Search Filter for the Role assigned to all users who should not see this sensitive data.For example, if your log line looks like this: 2020-09-0...
-
Graham Watts commented,
Official comment Hello Kunihko,Please log a support ticket here so that we can investigate and resolve this for you as quickly as possible: https://support.sumologic.com/hc/en-us/requests/new
-
Graham Watts commented,
Hi Kota,There are a few options here, parse anchor is probably the easiest assuming these fields are consistently in the order shown in your example log. _sourceCategory=<my/category>| parse "* | *...
-
Graham Watts commented,
Official comment Hey Soumya,You can plot both series in one table like this: (_sourceCategory=app1 or _sourceCategory=app2) "HTTP/1.1 500" | count by _sourceCategory| sort _count You could also plot these over ti...
-
Graham Watts commented,
Hi Sagan, You can use our new feature, Ingest Budgets, to apply a limit of collection per collector. This assumes you have an Enterprise Sumo subscription. Let us know if this is what you are looki...
-
Graham Watts commented,
Official comment Hey David,Can you try this query and let us know if this is what you're trying to see? _sourceCategory=prod/network| count by _sourceHost // assuming these are the source IPs| count by _sourceHost ...