dashboardsumologic

Sumologic query to show data by date


I have created Sumologic dashboard to show some errors in the application. What I want is show the error per date. It show the error but it doesn't aggregate the same error messages as the messages have some GUID. This is the sample part of the query:

_sourceCategory="playGames/web-app-us"
and ERR
| timeslice 1d
| count _timeslice, message

enter image description here


Solution

  • I believe you need to format the message and remove the GUID. So all the messages with GUID will be aggregate to single message. You can use regex to format the messages and remove the GUID. The sample query look like this and use as needed. The sample error message is like this

    Error occurred. Exception: System.Exception: my custom error message: 1121fd05-065b-499f-b174-2a13efdaf8b5
    

    And the Sumologic query

    _sourceCategory="dev/test-app"
    and "[Error]"
    and "Error occurred"
    // | timeslice 1d
    | formatDate(_receiptTime, "yyyy-MM-dd") as date
    | replace(_raw,/my custom error message: ([0-9A-Fa-f\-]{36})/,"my custom error message") as finalMessage
    | count date, finalMessage
    | transpose row date column finalMessage 
    

    This video shows step by step guidance. https://youtu.be/Nxzp7G-rUh8

    enter image description here