Sumo Logic, profile picture
Uploaded bySumo Logic
PDF, PPTX745 views

Sumo Logic QuickStart Webinar

This document is a quickstart guide for using Sumo Logic, covering data collection, searching, analysis, and visualization. It highlights key features such as real-time monitoring, compliance with security standards, and tools for troubleshooting IT infrastructure. The guide also provides insights into optimizing search performance and includes links to resources for further learning.

Embed presentation

Download as PDF, PPTX
Sumo Logic Confidential QuickStart Webinar Getting Started with Sumo Logic Mario Sánchez September 2015
Sumo Logic Confidential Agenda   What is Sumo Logic?   Key Points Regarding Data Collection   Searching, Parsing and Analyzing Data   Visualizing and Monitoring - Dashboards   Introduction to Library and Apps   Introduction to Performance Tools
Sumo Logic Confidential What is Sumo Logic?
Sumo Logic Confidential From Data to Decisions DEVOPS IT INFRASTRUCTURE AND OPERATIONS COMPLIANCE AND SECURITY DEVOPS Streamline continuous delivery Monitor KPI’s and Metrics Accelerate Troubleshooting IT INFRASTRUCTURE AND OPERATIONS Monitor all workloads Troubleshoot and increase uptime Simplify, Modernize, and save costs COMPLIANCE AND SECURITY Automate and demonstrate compliance Audit all systems Think beyond rules Sumo Logic Cloud Analytics Service
Sumo Logic Confidential The Sumo Logic Service DEVOPS IT INFRASTRUCTURE AND OPERATIONS COMPLIANCE AND SECURITY Collect and Centralize: Effortlessly collect terabytes of data from anywhere Search and Analyze: Run searches and correlate events in real-time Detect and Predict: Detect outliers and deviations to uncover the unknowns Monitor and Visualize: Easily monitor and visualize your data in real-time Alert and Notify: Proactively notifies you when specific events are identified
Sumo Logic Confidential Securing your Data Compliance and Certifications on top of AWS Security •  PCI/DSS 3.0 Service Provider Level 1 Certified •  AES 256-bit encryption at rest •  SSL encryption in transit •  U.S. – E.U. Safe Harbor attestation •  SOC 2, Type II attestation •  HIPAA compliant •  FIPS 140 compliant Resource: https://www.sumologic.com/resource/white-paper/securing-the-sumo-logic-service/
Sumo Logic Confidential Enterprise Logs are Everywhere Custom App Code Server / OS Virtual Databases Network Open Source Middleware Content Delivery IaaS, PaaS SaaS Security
Sumo Logic Confidential High-Level Data Flow
Sumo Logic Confidential Sumo Logic Data Flow Data Collection Search & Analyze Visualize & Monitor Alerts Dashboards Collectors Sources Operators Charts 1 2 3
Sumo Logic Confidential Data Collection
Sumo Logic Confidential Host A Collectors and Sources Apache Security Apache Performance Collector A Host B Collector B Host C Collector C Apache Security Apache Performance IIS Logs IIS W3C Logs
Sumo Logic Confidential Metadata Fields Name Description _collector Name of the collector this data came from _source Name of the source this data came through _sourceHost Hostname of the server this data came from _sourceName Name of the log file (including path) _sourceCategory Category designation of source data Tags added to your messages when data is collected Host A Apache Security Apache Performance Collector A
Sumo Logic Confidential Host A Metadata Field Usage Apache Security _sourceCategory = WS/Apache/Access Apache Performance _sourceCategory = WS/Apache/Performance Collector A Host B Collector B Host C Collector C Apache Security _sourceCategory = WS/Apache/Access Apache Performance _sourceCategory = WS/Apache/Performance IIS Logs _sourceCategory = WS/IIS IIS W3C Logs _sourceCategory = WS/IIS/W3C Sample Searches for _sourceCategory: = WS/Apache/Access = WS/Apache/* = WS/*
Sumo Logic Confidential Source Category Naming Convention   Simplifies Search Syntax and Scope Definitions   Used for other Sumo Logic features   Role-Based Access Control (Data Provisioning)   Partitioning (Search Optimization Tool)   Adopt a Robust Naming Convention Early   Ex: Prod/Sumo/Apache/Access à Env/Customer/Device/MessageType   Ex: OS/Windows/2012/Messages à Device/Vendor/Version/MessageType Blog Post: Good SourceCategory, Bad SourceCategory
Sumo Logic Confidential Search and Analyze
Sumo Logic Confidential Set your Preferences Set your Session Timeout Query Editing versus Running
Sumo Logic Confidential Search Basics Overview Time Range Histogram Search Bar Search Results Display Options
Sumo Logic Confidential Enter keywords and operators (separated by |) that build on top of each other Syntax: keyword | parse | where | group by | sort | limit Example: _sourceCategory=Apache/Access and GET | parse "GET * HTTP/1.1" * * "*"" as url, status_code, size, referrer | where !(status_code = 200 and status_code=304) | count by status_code | sort by status_code asc Search Syntax Flow Results where metadata keyword
Sumo Logic Confidential Full-text search expressions enable you to search for multiple terms and logical expressions –  Case insensitive –  Wildcard support –  Metadata field –  Boolean logic •  Complete (AND/OR) •  Implicit AND Keyword Expression
Sumo Logic Confidential •  The data available to your search request is determined by the selected time range. –  Pre-populated •  Last 15 min, Last 3 Hrs, Today –  Absolute •  12:25 12:30 •  8/11 12:00 8/11 13:00 –  Relative •  -5m •  -2h •  -2h -1h Time Range
Sumo Logic Confidential (Error* OR fail* OR except*) AND _sourceCategory=*apache* Syntax Example 1: Boolean logic, wildcards and metadata
Sumo Logic Confidential (_sourceCategory=Apache/Access AND !"Macintosh; Intel Mac OS X 10_6_8") AND *GET Syntax Example 2: Exact String Matching
Sumo Logic Confidential Refining Results by Surrounding Messages
Sumo Logic Confidential •  LogReduce uses fuzzy logic and soft matching to cluster messages providing quick investigation view into your environment. (Error OR fail*) | summarize Looking for the Unknown
Sumo Logic Confidential •  LogReduce uses fuzzy logic and soft matching to cluster messages providing quick investigation view into your environment. (Error OR fail*) | summarize •  Influencing the outcome Looking for the Unknown Sumo Logic Confidential
Sumo Logic Confidential •  Identify unexpectedly high or low values … |timeslice 1m |count by _timeslice |outlier _count Finding Outliers
Sumo Logic Confidential –  Timeslices are required –  Adjustable variables allow you to get the right sensitivity •  Threshold –  Number of rolling stddev above/below the moving average –  Default: 3 •  Consecutive –  Number of consecutive points above/below the threshold to trigger –  Default: 1 •  Direction –  Detect high values, low values or both –  Default: Both •  Window –  Number of trailing timeslices used to calculate –  Default: 10 Finding Outliers (continued)
Sumo Logic Confidential •  Parsing enables a user to extract parts of a message and classify them as fields. –  A specific key/value you want to extract –  Enables you to perform additional operations •  Logical/conditional – based on values •  Mathematical – operations on value sets •  Ways of defining fields –  Parse anchor: leverages start and stop anchors –  Parse regex: extracts nested information via regexField extraction Extracting Additional Labels/Fields
Sumo Logic Confidential •  Single field example Parse Anchor Using the UI
Sumo Logic Confidential •  The count Operator enables you to group messages that match a classification –  No Group: provides a total message count •  Ex: * | count •  Ex: : * | count as mycount The count operator
Sumo Logic Confidential •  Dissecting your result sets using metadata fields –  Ability to aggregate results sets and grouping them by metadata fields •  EX: _collector=*apache* | count by _sourceCategory –  Get a count of grouped result sets •  Ex: (Error OR fail*)| count by _sourcecategory , _sourcehost –  Organize Results by Count •  Ex: _collector=*apache*| count by _sourceCategory | sort by _count Leveraging Metadata for grouping
Sumo Logic Confidential •  Timeslice operator enables you to segment your results by time buckets –  Minute (timeslice by 5m) –  Hour (timeslice by 1h) –  Day (timeslice by 1d) Time-based Grouping
Sumo Logic Confidential Visualize and Monitor
Sumo Logic Confidential •  Collection of Monitors that provide graphical representation of data –  Each Monitor processes results of a search for display –  Drilldown for additional analysis •  Drill to another dashboard •  Drill into the query behind the dashboard Introduction to Dashboards
Sumo Logic Confidential •  Chart Types –  Table –  Bar –  Column –  Line –  Area –  Pie –  Box Plot –  Google Maps –  Single Value Providing Context through Visualization
Sumo Logic Confidential –  Live Dashboards •  Provides a live stream of data •  No back filling of data –  Interactive Dashboards •  Search based (On-Demand) •  Backfilling of data •  Support Filtering Dashboard Types No Interaction Ability to use Pre-defined filters
Sumo Logic Confidential Live Dashboards versus Interactive Dashboards
Sumo Logic Confidential Dashboards - Adding a Panel 1. Perform your Search 2. Format your Results 3. Create a Panel
Sumo Logic Confidential Jumpstart with Apps
Sumo Logic Confidential Installing Applications
Sumo Logic Confidential Managing Performance
Sumo Logic Confidential Factors in Search Performance   Query Structure   Time range   Data Selectivity (keywords, metadata, where statements)   Heavy Operations (join, transaction, summarize)   Overall Data Volume   System load   Improve search experience using Optimization Tools
Sumo Logic Confidential Search Optimization Tools   Partitions  Separate index for searching over a smaller data set   Scheduled Views  Pre-aggregating data for fast counts/sums over longer time ranges   Field Extraction Rules  Parse the data on ingest rather than run-time; simplifies searches  Take advantage of interactive dashboard filters
Sumo Logic Confidential Questions? Additional Resources   Search Online Documentation   Search/Post to Community Forums   Search, post, respond   Submit/vote for feature requests   Submit Tips & Tricks   Open a Support Case   Sumo Logic Services   Customer Success, Professional Services, Training
Sumo Logic Confidential Helpful Links Support Portal, Documentation, Community Forums, Feature Requests https://support.sumologic.com/home (Help -> Support from SL Service) Resources (Whitepapers, videos, screencasts) https://www.sumologic.com/resource/ Blog Posts https://www.sumologic.com/blog/ Services customer-success@sumologic.com
Sumo Logic Confidential Feature Spotlight Series: How TuneIn uses Outlier Detection and Predictive Analytics Sep 22, 2015, 10am Pacific Register Now “How To” Webinars: Optimizing Your Search Experience Sep 23, 2015, 10am Pacific Register Now
Sumo Logic Confidential Thank you!

More Related Content

PPTX
Sumo Logic QuickStart
bySumo Logic
 
PDF
Sumo Logic Quickstart Training 10/14/2015
bySumo Logic
 
PDF
Sumo Logic - Optimizing Your Search Experience (2016-08-17)
bySumo Logic
 
PDF
Level 3 Certification: Setting up Sumo Logic - Oct 2018
bySumo Logic
 
PPTX
Sumo Logic "How to" Webinar: Advanced Analytics
bySumo Logic
 
PPTX
Sumo Logic QuickStart Webinar July 2016
bySumo Logic
 
PDF
How To Webinar - Sumo Logic API
bySumo Logic
 
PDF
Optimizing Your Search Experience
bySumo Logic
 
Sumo Logic QuickStart
bySumo Logic
 
Sumo Logic Quickstart Training 10/14/2015
bySumo Logic
 
Sumo Logic - Optimizing Your Search Experience (2016-08-17)
bySumo Logic
 
Level 3 Certification: Setting up Sumo Logic - Oct 2018
bySumo Logic
 
Sumo Logic "How to" Webinar: Advanced Analytics
bySumo Logic
 
Sumo Logic QuickStart Webinar July 2016
bySumo Logic
 
How To Webinar - Sumo Logic API
bySumo Logic
 
Optimizing Your Search Experience
bySumo Logic
 

What's hot

PPTX
Using Sumo Logic - Apr 2018
bySumo Logic
 
PPTX
"How to" Webinar: Sending Data to Sumo Logic
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Metrics Mastery
bySumo Logic
 
PPTX
Welcome Webinar Slides
bySumo Logic
 
PDF
Level 2 Certification: Using Sumo Logic - Oct 2018
bySumo Logic
 
PDF
Security Certification: Security Analytics using Sumo Logic - Oct 2018
bySumo Logic
 
PPTX
Sumo Logic QuickStart Webinar - Get Certified
bySumo Logic
 
PPTX
Logging tracing and metrics in .NET Core and Azure - dotnetdays 2020
byAlex Thissen
 
PPT
Boosting Documents in Solr by Recency, Popularity, and User Preferences
byLucidworks (Archived)
 
PDF
Building a real time big data analytics platform with solr
byTrey Grainger
 
PDF
Relevance in the Wild - Daniel Gomez Vilanueva, Findwise
byLucidworks
 
PPTX
Sumo Logic QuickStart - May 2016
bySumo Logic
 
PPTX
Sumo Logic quickStart Webinar June 2016
bySumo Logic
 
PDF
Sumo Logic Quick Start - Feb 2016
bySumo Logic
 
PPTX
Setting Up Sumo Logic - Sep 2017
bymariosany
 
PPTX
Sumo Logic "How To" Webinar: Apps
bySumo Logic
 
PPTX
How to Webinar: Sumo Logic Dashboards
bySumo Logic
 
PDF
Evolving The Optimal Relevancy Scoring Model at Dice.com: Presented by Simon ...
byLucidworks
 
PDF
Real Time Indexing and Search - Ashwani Kapoor & Girish Gudla, Trulia
byLucidworks
 
PDF
Welcome Webinar PDF
bySumo Logic
 
Using Sumo Logic - Apr 2018
bySumo Logic
 
"How to" Webinar: Sending Data to Sumo Logic
bySumo Logic
 
Sumo Logic Cert Jam - Metrics Mastery
bySumo Logic
 
Welcome Webinar Slides
bySumo Logic
 
Level 2 Certification: Using Sumo Logic - Oct 2018
bySumo Logic
 
Security Certification: Security Analytics using Sumo Logic - Oct 2018
bySumo Logic
 
Sumo Logic QuickStart Webinar - Get Certified
bySumo Logic
 
Logging tracing and metrics in .NET Core and Azure - dotnetdays 2020
byAlex Thissen
 
Boosting Documents in Solr by Recency, Popularity, and User Preferences
byLucidworks (Archived)
 
Building a real time big data analytics platform with solr
byTrey Grainger
 
Relevance in the Wild - Daniel Gomez Vilanueva, Findwise
byLucidworks
 
Sumo Logic QuickStart - May 2016
bySumo Logic
 
Sumo Logic quickStart Webinar June 2016
bySumo Logic
 
Sumo Logic Quick Start - Feb 2016
bySumo Logic
 
Setting Up Sumo Logic - Sep 2017
bymariosany
 
Sumo Logic "How To" Webinar: Apps
bySumo Logic
 
How to Webinar: Sumo Logic Dashboards
bySumo Logic
 
Evolving The Optimal Relevancy Scoring Model at Dice.com: Presented by Simon ...
byLucidworks
 
Real Time Indexing and Search - Ashwani Kapoor & Girish Gudla, Trulia
byLucidworks
 
Welcome Webinar PDF
bySumo Logic
 

Similar to Sumo Logic QuickStart Webinar

PPTX
Sumo Logic Quickstart - Jan 2017
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Administration
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Fundamentals
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Security & Compliance
bySumo Logic
 
PDF
Sumo Logic Certification - Level 2 (Using Sumo)
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Security Analytics
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Metrics Mastery
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Search Mastery
bySumo Logic
 
PPTX
Sumo Logic: Optimizing Scheduled Searches
bySumo Logic
 
PDF
Sumo Logic QuickStart Webinar - Jan 2016
bySumo Logic
 
PPTX
Sumo Logic Quickstart - Nv 2016
bySumo Logic
 
PPTX
Sumo Logic QuickStart Webinar - Dec 2016
bySumo Logic
 
PPTX
Sumo Logic QuickStart Webinar Oct 2016
bySumo Logic
 
PPTX
Sumo Logic QuickStat - Apr 2017
bySumo Logic
 
PPTX
Sumo Logic QuickStart Webinar Sep 2016
bySumo Logic
 
PPTX
Setting Up Sumo Logic - Apr 2017
bySumo Logic
 
PPTX
Setting up Sumo Logic - June 2017
bySumo Logic
 
PPTX
Machine Analytics: Correlate Your Logs and Metrics
bySumo Logic
 
PDF
How to Webinar: Monitoring through Alerts
bySumo Logic
 
PDF
Tech Chat – What's New in Sumo Logic
bySumo Logic
 
Sumo Logic Quickstart - Jan 2017
bySumo Logic
 
Sumo Logic Cert Jam - Administration
bySumo Logic
 
Sumo Logic Cert Jam - Fundamentals
bySumo Logic
 
Sumo Logic Cert Jam - Security & Compliance
bySumo Logic
 
Sumo Logic Certification - Level 2 (Using Sumo)
bySumo Logic
 
Sumo Logic Cert Jam - Security Analytics
bySumo Logic
 
Sumo Logic Cert Jam - Metrics Mastery
bySumo Logic
 
Sumo Logic Cert Jam - Search Mastery
bySumo Logic
 
Sumo Logic: Optimizing Scheduled Searches
bySumo Logic
 
Sumo Logic QuickStart Webinar - Jan 2016
bySumo Logic
 
Sumo Logic Quickstart - Nv 2016
bySumo Logic
 
Sumo Logic QuickStart Webinar - Dec 2016
bySumo Logic
 
Sumo Logic QuickStart Webinar Oct 2016
bySumo Logic
 
Sumo Logic QuickStat - Apr 2017
bySumo Logic
 
Sumo Logic QuickStart Webinar Sep 2016
bySumo Logic
 
Setting Up Sumo Logic - Apr 2017
bySumo Logic
 
Setting up Sumo Logic - June 2017
bySumo Logic
 
Machine Analytics: Correlate Your Logs and Metrics
bySumo Logic
 
How to Webinar: Monitoring through Alerts
bySumo Logic
 
Tech Chat – What's New in Sumo Logic
bySumo Logic
 

More from Sumo Logic

PPTX
Sumo Logic Cert Jam - Fundamentals (Spanish)
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Advanced Metrics with Kubernetes
bySumo Logic
 
PPTX
Bring your Graphite-compatible metrics into Sumo Logic
bySumo Logic
 
PPTX
Sumo Logic Search Job API
bySumo Logic
 
PPTX
Scaling Your Tools for Your Modern Application
bySumo Logic
 
PPTX
Sumo Logic Cert Jam - Advanced Metrics with Kubernetes
bySumo Logic
 
PPTX
Making the Shift from DevOps to Practical DevSecOps | Sumo Logic Webinar
bySumo Logic
 
PPTX
You Build It, You Secure It: Introduction to DevSecOps
bySumo Logic
 
Sumo Logic Cert Jam - Fundamentals (Spanish)
bySumo Logic
 
Sumo Logic Cert Jam - Advanced Metrics with Kubernetes
bySumo Logic
 
Bring your Graphite-compatible metrics into Sumo Logic
bySumo Logic
 
Sumo Logic Search Job API
bySumo Logic
 
Scaling Your Tools for Your Modern Application
bySumo Logic
 
Sumo Logic Cert Jam - Advanced Metrics with Kubernetes
bySumo Logic
 
Making the Shift from DevOps to Practical DevSecOps | Sumo Logic Webinar
bySumo Logic
 
You Build It, You Secure It: Introduction to DevSecOps
bySumo Logic
 

Recently uploaded

PDF
One Agent to Rule Them All - The Fellowship of AI Agents
byIvo Andreev
 
PDF
Constraints First - Why Our On-Prem Ticketing System Starts With Limits, Not ...
bySpirit Face
 
PPTX
SNG460-CNG489_Week8_17-21Nov25_Chp8-OdtuClass.pptx
byberayseray382
 
PPTX
Code Assessment Tools .pptx
byCodexpro
 
PPTX
Road_Quality_Indicator using deeplearning algorithms and computer vision
byDHARUNPRASHOBMM
 
PDF
How NetSuite Cloud ERP Helps Businesses Overcome Legacy System Downtime.
byTechWize
 
PPTX
Python-Functions-A-Comprehensive-Overview.pptx
byMuhammad Fahad Bashir
 
PPTX
NSF Converter Software to Convert NSF to PST, EML, MSG
byNSF Converter Software
 
PDF
Manual vs Automated Accessibility Testing – What to Choose in 2025.pdf
bykalichargn70th171
 
PPTX
Modern P&C Insurance Software for Smarter, Faster Operations.pptx
byInsurance Tech Services
 
PPTX
Week 7 Introduction to HTML PowerPoint Notes.pptx
bylesandawelgens
 
PPTX
AI Agent Overview - Why we need AI Agent
byAlokGope
 
PPTX
application security presentation 2 by harman
byharmanideapad
 
PDF
nsfconvertersoftwaretoconvertNSFtoPST.pdf
byNSF Converter Software
 
PPTX
SAP FICO Training Agenda for new learners
bysasidhar unnagiri
 
PPTX
List on Python Programming Language.pptx
byRICHARDALONSAGAY1
 
PPTX
AI Clinic Management Software for Pulmonology Clinics Bringing Clarity, Contr...
byEasy Clinic
 
PDF
DSD-INT 2025 Integrating Nature-Based Solutions into Hydrological Models A Li...
byDeltares
 
PDF
DSD-INT 2025 Stochastic flood event generation using wflow and a diffusion do...
byDeltares
 
PPTX
1_MIL_Introduction_Influence-of-Media-and-Information-on-Communication (1).pptx
byDeltaDomsMamas1
 
One Agent to Rule Them All - The Fellowship of AI Agents
byIvo Andreev
 
Constraints First - Why Our On-Prem Ticketing System Starts With Limits, Not ...
bySpirit Face
 
SNG460-CNG489_Week8_17-21Nov25_Chp8-OdtuClass.pptx
byberayseray382
 
Code Assessment Tools .pptx
byCodexpro
 
Road_Quality_Indicator using deeplearning algorithms and computer vision
byDHARUNPRASHOBMM
 
How NetSuite Cloud ERP Helps Businesses Overcome Legacy System Downtime.
byTechWize
 
Python-Functions-A-Comprehensive-Overview.pptx
byMuhammad Fahad Bashir
 
NSF Converter Software to Convert NSF to PST, EML, MSG
byNSF Converter Software
 
Manual vs Automated Accessibility Testing – What to Choose in 2025.pdf
bykalichargn70th171
 
Modern P&C Insurance Software for Smarter, Faster Operations.pptx
byInsurance Tech Services
 
Week 7 Introduction to HTML PowerPoint Notes.pptx
bylesandawelgens
 
AI Agent Overview - Why we need AI Agent
byAlokGope
 
application security presentation 2 by harman
byharmanideapad
 
nsfconvertersoftwaretoconvertNSFtoPST.pdf
byNSF Converter Software
 
SAP FICO Training Agenda for new learners
bysasidhar unnagiri
 
List on Python Programming Language.pptx
byRICHARDALONSAGAY1
 
AI Clinic Management Software for Pulmonology Clinics Bringing Clarity, Contr...
byEasy Clinic
 
DSD-INT 2025 Integrating Nature-Based Solutions into Hydrological Models A Li...
byDeltares
 
DSD-INT 2025 Stochastic flood event generation using wflow and a diffusion do...
byDeltares
 
1_MIL_Introduction_Influence-of-Media-and-Information-on-Communication (1).pptx
byDeltaDomsMamas1
 

Sumo Logic QuickStart Webinar

  • 1.
    Sumo Logic Confidential QuickStartWebinar Getting Started with Sumo Logic Mario Sánchez September 2015
  • 2.
    Sumo Logic Confidential Agenda  What is Sumo Logic?   Key Points Regarding Data Collection   Searching, Parsing and Analyzing Data   Visualizing and Monitoring - Dashboards   Introduction to Library and Apps   Introduction to Performance Tools
  • 3.
  • 4.
    Sumo Logic Confidential FromData to Decisions DEVOPS IT INFRASTRUCTURE AND OPERATIONS COMPLIANCE AND SECURITY DEVOPS Streamline continuous delivery Monitor KPI’s and Metrics Accelerate Troubleshooting IT INFRASTRUCTURE AND OPERATIONS Monitor all workloads Troubleshoot and increase uptime Simplify, Modernize, and save costs COMPLIANCE AND SECURITY Automate and demonstrate compliance Audit all systems Think beyond rules Sumo Logic Cloud Analytics Service
  • 5.
    Sumo Logic Confidential TheSumo Logic Service DEVOPS IT INFRASTRUCTURE AND OPERATIONS COMPLIANCE AND SECURITY Collect and Centralize: Effortlessly collect terabytes of data from anywhere Search and Analyze: Run searches and correlate events in real-time Detect and Predict: Detect outliers and deviations to uncover the unknowns Monitor and Visualize: Easily monitor and visualize your data in real-time Alert and Notify: Proactively notifies you when specific events are identified
  • 6.
    Sumo Logic Confidential Securingyour Data Compliance and Certifications on top of AWS Security •  PCI/DSS 3.0 Service Provider Level 1 Certified •  AES 256-bit encryption at rest •  SSL encryption in transit •  U.S. – E.U. Safe Harbor attestation •  SOC 2, Type II attestation •  HIPAA compliant •  FIPS 140 compliant Resource: https://www.sumologic.com/resource/white-paper/securing-the-sumo-logic-service/
  • 7.
    Sumo Logic Confidential EnterpriseLogs are Everywhere Custom App Code Server / OS Virtual Databases Network Open Source Middleware Content Delivery IaaS, PaaS SaaS Security
  • 8.
  • 9.
    Sumo Logic Confidential SumoLogic Data Flow Data Collection Search & Analyze Visualize & Monitor Alerts Dashboards Collectors Sources Operators Charts 1 2 3
  • 10.
  • 11.
    Sumo Logic Confidential HostA Collectors and Sources Apache Security Apache Performance Collector A Host B Collector B Host C Collector C Apache Security Apache Performance IIS Logs IIS W3C Logs
  • 12.
    Sumo Logic Confidential MetadataFields Name Description _collector Name of the collector this data came from _source Name of the source this data came through _sourceHost Hostname of the server this data came from _sourceName Name of the log file (including path) _sourceCategory Category designation of source data Tags added to your messages when data is collected Host A Apache Security Apache Performance Collector A
  • 13.
    Sumo Logic Confidential HostA Metadata Field Usage Apache Security _sourceCategory = WS/Apache/Access Apache Performance _sourceCategory = WS/Apache/Performance Collector A Host B Collector B Host C Collector C Apache Security _sourceCategory = WS/Apache/Access Apache Performance _sourceCategory = WS/Apache/Performance IIS Logs _sourceCategory = WS/IIS IIS W3C Logs _sourceCategory = WS/IIS/W3C Sample Searches for _sourceCategory: = WS/Apache/Access = WS/Apache/* = WS/*
  • 14.
    Sumo Logic Confidential SourceCategory Naming Convention   Simplifies Search Syntax and Scope Definitions   Used for other Sumo Logic features   Role-Based Access Control (Data Provisioning)   Partitioning (Search Optimization Tool)   Adopt a Robust Naming Convention Early   Ex: Prod/Sumo/Apache/Access à Env/Customer/Device/MessageType   Ex: OS/Windows/2012/Messages à Device/Vendor/Version/MessageType Blog Post: Good SourceCategory, Bad SourceCategory
  • 15.
  • 16.
    Sumo Logic Confidential Setyour Preferences Set your Session Timeout Query Editing versus Running
  • 17.
    Sumo Logic Confidential SearchBasics Overview Time Range Histogram Search Bar Search Results Display Options
  • 18.
    Sumo Logic Confidential Enterkeywords and operators (separated by |) that build on top of each other Syntax: keyword | parse | where | group by | sort | limit Example: _sourceCategory=Apache/Access and GET | parse "GET * HTTP/1.1" * * "*"" as url, status_code, size, referrer | where !(status_code = 200 and status_code=304) | count by status_code | sort by status_code asc Search Syntax Flow Results where metadata keyword
  • 19.
    Sumo Logic Confidential Full-textsearch expressions enable you to search for multiple terms and logical expressions –  Case insensitive –  Wildcard support –  Metadata field –  Boolean logic •  Complete (AND/OR) •  Implicit AND Keyword Expression
  • 20.
    Sumo Logic Confidential • The data available to your search request is determined by the selected time range. –  Pre-populated •  Last 15 min, Last 3 Hrs, Today –  Absolute •  12:25 12:30 •  8/11 12:00 8/11 13:00 –  Relative •  -5m •  -2h •  -2h -1h Time Range
  • 21.
    Sumo Logic Confidential (Error*OR fail* OR except*) AND _sourceCategory=*apache* Syntax Example 1: Boolean logic, wildcards and metadata
  • 22.
    Sumo Logic Confidential (_sourceCategory=Apache/AccessAND !"Macintosh; Intel Mac OS X 10_6_8") AND *GET Syntax Example 2: Exact String Matching
  • 23.
    Sumo Logic Confidential RefiningResults by Surrounding Messages
  • 24.
    Sumo Logic Confidential • LogReduce uses fuzzy logic and soft matching to cluster messages providing quick investigation view into your environment. (Error OR fail*) | summarize Looking for the Unknown
  • 25.
    Sumo Logic Confidential • LogReduce uses fuzzy logic and soft matching to cluster messages providing quick investigation view into your environment. (Error OR fail*) | summarize •  Influencing the outcome Looking for the Unknown Sumo Logic Confidential
  • 26.
    Sumo Logic Confidential • Identify unexpectedly high or low values … |timeslice 1m |count by _timeslice |outlier _count Finding Outliers
  • 27.
    Sumo Logic Confidential – Timeslices are required –  Adjustable variables allow you to get the right sensitivity •  Threshold –  Number of rolling stddev above/below the moving average –  Default: 3 •  Consecutive –  Number of consecutive points above/below the threshold to trigger –  Default: 1 •  Direction –  Detect high values, low values or both –  Default: Both •  Window –  Number of trailing timeslices used to calculate –  Default: 10 Finding Outliers (continued)
  • 28.
    Sumo Logic Confidential • Parsing enables a user to extract parts of a message and classify them as fields. –  A specific key/value you want to extract –  Enables you to perform additional operations •  Logical/conditional – based on values •  Mathematical – operations on value sets •  Ways of defining fields –  Parse anchor: leverages start and stop anchors –  Parse regex: extracts nested information via regexField extraction Extracting Additional Labels/Fields
  • 29.
    Sumo Logic Confidential • Single field example Parse Anchor Using the UI
  • 30.
    Sumo Logic Confidential • The count Operator enables you to group messages that match a classification –  No Group: provides a total message count •  Ex: * | count •  Ex: : * | count as mycount The count operator
  • 31.
    Sumo Logic Confidential • Dissecting your result sets using metadata fields –  Ability to aggregate results sets and grouping them by metadata fields •  EX: _collector=*apache* | count by _sourceCategory –  Get a count of grouped result sets •  Ex: (Error OR fail*)| count by _sourcecategory , _sourcehost –  Organize Results by Count •  Ex: _collector=*apache*| count by _sourceCategory | sort by _count Leveraging Metadata for grouping
  • 32.
    Sumo Logic Confidential • Timeslice operator enables you to segment your results by time buckets –  Minute (timeslice by 5m) –  Hour (timeslice by 1h) –  Day (timeslice by 1d) Time-based Grouping
  • 33.
  • 34.
    Sumo Logic Confidential • Collection of Monitors that provide graphical representation of data –  Each Monitor processes results of a search for display –  Drilldown for additional analysis •  Drill to another dashboard •  Drill into the query behind the dashboard Introduction to Dashboards
  • 35.
    Sumo Logic Confidential • Chart Types –  Table –  Bar –  Column –  Line –  Area –  Pie –  Box Plot –  Google Maps –  Single Value Providing Context through Visualization
  • 36.
    Sumo Logic Confidential – Live Dashboards •  Provides a live stream of data •  No back filling of data –  Interactive Dashboards •  Search based (On-Demand) •  Backfilling of data •  Support Filtering Dashboard Types No Interaction Ability to use Pre-defined filters
  • 37.
    Sumo Logic Confidential LiveDashboards versus Interactive Dashboards
  • 38.
    Sumo Logic Confidential Dashboards- Adding a Panel 1. Perform your Search 2. Format your Results 3. Create a Panel
  • 39.
  • 40.
  • 41.
  • 42.
    Sumo Logic Confidential Factorsin Search Performance   Query Structure   Time range   Data Selectivity (keywords, metadata, where statements)   Heavy Operations (join, transaction, summarize)   Overall Data Volume   System load   Improve search experience using Optimization Tools
  • 43.
    Sumo Logic Confidential SearchOptimization Tools   Partitions  Separate index for searching over a smaller data set   Scheduled Views  Pre-aggregating data for fast counts/sums over longer time ranges   Field Extraction Rules  Parse the data on ingest rather than run-time; simplifies searches  Take advantage of interactive dashboard filters
  • 44.
    Sumo Logic Confidential Questions? AdditionalResources   Search Online Documentation   Search/Post to Community Forums   Search, post, respond   Submit/vote for feature requests   Submit Tips & Tricks   Open a Support Case   Sumo Logic Services   Customer Success, Professional Services, Training
  • 45.
    Sumo Logic Confidential HelpfulLinks Support Portal, Documentation, Community Forums, Feature Requests https://support.sumologic.com/home (Help -> Support from SL Service) Resources (Whitepapers, videos, screencasts) https://www.sumologic.com/resource/ Blog Posts https://www.sumologic.com/blog/ Services customer-success@sumologic.com
  • 46.
    Sumo Logic Confidential FeatureSpotlight Series: How TuneIn uses Outlier Detection and Predictive Analytics Sep 22, 2015, 10am Pacific Register Now “How To” Webinars: Optimizing Your Search Experience Sep 23, 2015, 10am Pacific Register Now
  • 47.