David Marcoux

1. Community
2. Sending Data
3. Dealing with null values

Something like this might work: if(isnull(sqoopcost),0,sqoopcost ) as sqoopcost

• View comment
• David Marcoux
• September 04, 2015 17:50
• 0 votes

1. Community
2. Sending Data
3. Trying to create a Cisco ASA firewall dropping table

Hi Brannen, To achieve the "running list" type of display that you want you could add _messagetime as one of your fields. This basically ensures that log data isn't rolled up. Try something like...

• View comment
• David Marcoux
• September 04, 2015 17:47
• 0 votes

1. Community
2. Sending Data
3. How do I query for most recent log entry per host?

Try this query over the past 30 days. It provides a lot of really helpful information about _sourcehosts that have stopped sending logs.  Note, there are a few configurable parameters inside the qu...

• View comment
• David Marcoux
• May 11, 2015 18:44
• 0 votes

1. Community
2. Sending Data
3. Top 10 Systems Administrator Searches

Did you see the "Suggested Searches for Linux OS Systems" help page? https://service.us2.sumologic.com/help/Default.htm#Linux_OS.htm%3FTocPath%3DSearching%2520Data%7CSearch%2520Query%2520Language%...

• View comment
• David Marcoux
• April 30, 2015 15:02
• 1 vote

1. Community
2. Sending Data
3. How to translate splunk queries into sumologic queries

Any guides, overviews, or personal experience stories of converting queries would be helpful for me too.

• View comment
• David Marcoux
• March 03, 2015 15:20
• 0 votes