SumoLogic Concepts: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
(→Search) |
||
| Line 8: | Line 8: | ||
[[#Keyword_Search|keyword search]] ''or'' [[#String_Search|string search]] | parse | where | group-by | sort | limit | [[#Keyword_Search|keyword search]] ''or'' [[#String_Search|string search]] | parse | where | group-by | sort | limit | ||
All queries start with a [[#Keyword_Search|keyword search]] or a [[#String_Search|string search]]. | |||
==Keyword Search== | ==Keyword Search== | ||
Revision as of 03:06, 30 January 2019
Internal
Search
The search syntax is based on the "funnel" or the "pipeline" concept. The pipeline input receives all SumoLogic data, and data is filtered b entering keywords and operators, separated by pipes ("|"). Each operator acts on the results produced by previous operators, so data is being progressively filtered out. The typical search query syntax is similar to:
keyword search or string search | parse | where | group-by | sort | limit
All queries start with a keyword search or a string search.