Kelly Hamm

1. Community
2. Using Sumo Logic
3. How would I set an alarm from a _sourceName value that is returning a 21% message and set an alarm when that message is greater= to 85%, send an email?

Hi, assuming this is the intact multiline message you've posted: | parse "message=*%" as perc | where perc>=85 | count by _sourceName set that up in a scheduled search, choose your timeframes an...

• View comment
• Kelly Hamm
• July 19, 2016 15:26
• 0 votes

1. Community
2. Using Sumo Logic
3. How to display other fields of the "last" event.

Hi David- how about something like this? If you're using a parsed field from the data set other than the sumo reserved _messagetime that's not epoch, you can put that in there and remove the format...

• View comment
• Kelly Hamm
• July 13, 2016 20:33
• 0 votes

1. Community
2. Using Sumo Logic
3. Find a specific user from active directory logs

Hi Saad- if you're using Field Extractions you could have a query like this: _SourceCategory=Win* dest_user=zz* | count by dest_user because the field is preparsed with FER, you could use it in t...

• View comment
• Kelly Hamm
• July 13, 2016 13:46
• 0 votes

1. Community
2. Using Sumo Logic
3. Geo map display US only?

Hi Will- you can add a WHERE clause using either the country_code or country_name after the lookup: | count by src_ip | lookup latitude, longitude, country_code, country_name from geo://default on...

• View comment
• Kelly Hamm
• July 06, 2016 14:31
• 0 votes

1. Community
2. Applications and Integrations
3. API search jobs with queries involving parse

Hi Sepehr- yep, you'll to encode the query, an easy way to test this is to take your query and encode it with something like this: http://meyerweb.com/eric/tools/dencoder/ for instance, a query li...

• View comment
• Kelly Hamm
• July 01, 2016 21:42
• 0 votes

1. Community
2. Sending Data
3. Any recomendations on getting logs from proofpoint? API would be great, if not, exporting and reading log files would work. Thanks for any advise.

Hi Mark- How about sending via syslog from proofpoint to a sumo syslog source on a collector? https://www.youtube.com/watch?v=qPOgaXB6xBw https://help.sumologic.com/Send_Data/Sources/Syslog_Source

• View comment
• Kelly Hamm
• July 01, 2016 20:23
• 0 votes

1. Community
2. Using Sumo Logic
3. how to do a join query on pre-parsed fields

Hi MB- I would basically start with my search to create my initial scope, then use a simple where after the fact to break that scope out into my separate subtables I want to join: _sourcecategory...

• View comment
• Kelly Hamm
• June 23, 2016 14:40
• 0 votes

1. Community
2. Using Sumo Logic
3. Extracting details from JSON message.

Hi Will- how about this? | parse regex "(?\d+\.\d+\.\d+\.\d)\s", "user_id=*\"" as user

• View comment
• Kelly Hamm
• June 15, 2016 23:27
• 0 votes

1. Community
2. Using Sumo Logic
3. Piechart

Hi; In my experience, Pie charts work best with normalizing your multiple fields into a single field, and do a count by type from there. Basically, in your case i used a regex multi to parse out ...

• View comment
• Kelly Hamm
• June 07, 2016 15:01
• 0 votes