-
Notifications
You must be signed in to change notification settings - Fork 198
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added views docs #4522
base: main
Are you sure you want to change the base?
Added views docs #4522
Conversation
Co-authored-by: Kim (Sumo Logic) <[email protected]>
…ologic-documentation into views-doc-creation
You can forward log data from a [Partition](/docs/manage/partitions) or [Views](/docs/manage/views) to an S3 bucket. Only new data is forwarded from a Partition once it is set to forward data. | ||
|
||
After data forwarding is configured, you should start to see file objects posted within your configured bucket. If your Scheduled View conducts aggregation, which is a best practice, your aggregate fields are automatically appended to the forwarded objects. | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can forward log data from a [Partition](/docs/manage/partitions) or [Views](/docs/manage/views) to an S3 bucket. Only new data is forwarded from a Partition once it is set to forward data. | |
After data forwarding is configured, you should start to see file objects posted within your configured bucket. If your Scheduled View conducts aggregation, which is a best practice, your aggregate fields are automatically appended to the forwarded objects. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remove these paragraphs because they repeat text from the beginning of the article.
@@ -8,7 +8,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; | |||
|
|||
<img src={useBaseUrl('img/icons/operations/send-data.png')} alt="Document with a forward symbol icon" width="50"/> | |||
|
|||
Data Forwarding allows you to forward log data to an external server or supported storage service. You can forward log data to an AWS S3 bucket through [Partitions](/docs/manage/partitions) or [Scheduled Views](/docs/manage/scheduled-views). See [Forwarding Data from Sumo Logic to S3](/docs/manage/data-forwarding/amazon-s3-bucket/) for details. | |||
Data Forwarding allows you to forward log data to an external server or supported storage service. You can forward log data to an AWS S3 bucket through [Partitions](/docs/manage/partitions) or [Views](/docs/manage/views). See [Forwarding Data from Sumo Logic to S3](amazon-s3-bucket.md) for details. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Data Forwarding allows you to forward log data to an external server or supported storage service. You can forward log data to an AWS S3 bucket through [Partitions](/docs/manage/partitions) or [Views](/docs/manage/views). See [Forwarding Data from Sumo Logic to S3](amazon-s3-bucket.md) for details. | |
Data Forwarding allows you to forward log data to an external server or supported storage service. You can forward log data to an AWS S3 bucket through [Partitions](/docs/manage/partitions) or [Scheduled Views](/docs/manage/views/scheduled-views). See [Forwarding Data from Sumo Logic to S3](amazon-s3-bucket.md) for details. |
@@ -61,7 +61,7 @@ _index=sumologic_audit_events _sourceCategory=accessKeys | |||
| [Password Policy](/docs/manage/security/set-password-policy) | `passwordPolicy` | | |||
| [Roles](/docs/manage/users-roles/roles/create-manage-roles) | `roles` | | |||
| [SAML](/docs/manage/security/saml) | `saml` | | |||
| [Scheduled Views](/docs/manage/scheduled-views) | `scheduledView` | | |||
| [Scheduled Views](/docs/manage/views) | `scheduledView` | |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| [Scheduled Views](/docs/manage/views) | `scheduledView` | | |
| [Scheduled Views](/docs/manage/views/scheduled-views) | `scheduledView` | |
@@ -24,7 +24,7 @@ Following are the capabilities you can assign when you [create roles](create-ma | |||
| Manage Apps | Install and manage [apps](/docs/integrations). | | |||
| Manage Connections | Manage the [connections](/docs/alerts/webhook-connections/) that allow you to send alerts to other tools. | | |||
| View Connections | View [connections](/docs/alerts/webhook-connections/) on the **Connections** page. | | |||
| View Scheduled Views | [View Scheduled Views](/docs/manage/scheduled-views).| | |||
| View Scheduled Views | [View Scheduled Views](/docs/manage/views).| |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| View Scheduled Views | [View Scheduled Views](/docs/manage/views).| | |
| View Scheduled Views | [View Scheduled Views](/docs/manage/views/scheduled-views).| |
``` | ||
## Should I create a Scheduled View or use Save to Index? | ||
|
||
In most cases, if you can use a [Scheduled View](/docs/manage/views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In most cases, if you can use a [Scheduled View](/docs/manage/views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this. | |
In most cases, if you can use a [Scheduled View](/docs/manage/views/scheduled-views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this. |
<div className="box-wrapper"> | ||
<div className="box smallbox card"> | ||
<div className="container"> | ||
<a href="/docs/manage/views/scheduled-searches/add-schedule-search"><img src={useBaseUrl('img/icons/general/calendar.png')} alt="icon" width="40"/><h4>Create a Scheduled Search</h4></a> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
<a href="/docs/manage/views/scheduled-searches/add-schedule-search"><img src={useBaseUrl('img/icons/general/calendar.png')} alt="icon" width="40"/><h4>Create a Scheduled Search</h4></a> | |
<a href="/docs/manage/views/scheduled-searches/add-schedule-search"><img src={useBaseUrl('img/icons/general/calendar.png')} alt="icon" width="40"/><h4>Add a Scheduled Search</h4></a> |
The page has information about viewing information about the views/indexes configured for your organization. | ||
|
||
:::note | ||
You must have a role that grants you the View Scheduled Views [role capability](/docs/manage/views/view-list) in order to view information about scheduled views. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You must have a role that grants you the View Scheduled Views [role capability](/docs/manage/views/view-list) in order to view information about scheduled views. | |
You must have a role that grants you the View Scheduled Views [role capability](/docs/manage/users-roles/roles/role-capabilities/) in order to view information about scheduled views. |
@@ -7,4 +7,4 @@ Ingest Time FERs have the following limitations: | |||
* Ingest Time rule expressions are limited to a maximum of 16k (16,384) characters. | |||
* Ingest Time rules can extract up to a maximum of 16k (16,384) characters for each field. | |||
* The cumulative size of all fields extracted by a rule for a message/event is limited to 64kb. | |||
* Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/scheduled-views) to extract fields for your historical data. | |||
* Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/views) to extract fields for your historical data. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
* Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/views) to extract fields for your historical data. | |
* Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/views/scheduled-views) to extract fields for your historical data. |
@@ -24,7 +24,7 @@ When naming your index, use a name that's descriptive and easy to remember. Name | |||
|
|||
## Should I create a Scheduled View or use Save to Index? | |||
|
|||
In most cases, if you can use a [Scheduled View](/docs/manage/scheduled-views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this. | |||
In most cases, if you can use a [Scheduled View](/docs/manage/views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In most cases, if you can use a [Scheduled View](/docs/manage/views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this. | |
In most cases, if you can use a [Scheduled View](/docs/manage/views/scheduled-views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Wow, that's a lot of great stuff, @JV0812! I have only a few minor suggestions, mostly having to do with linking.
Co-authored-by: John Pipkin (Sumo Logic) <[email protected]>
Co-authored-by: John Pipkin (Sumo Logic) <[email protected]>
Co-authored-by: John Pipkin (Sumo Logic) <[email protected]>
Purpose of this pull request
This pull request is to add the Views docs.
Select the type of change
Ticket (if applicable)
Documentation for new Views page instead of existing Scheduled Page