restaggregatesumologic

How do I perform aggregate queries using SumoLogic APIs

I am trying to perform aggregate queries using SumoLogic APIs as mentioned here.

Something like:

_view = <some_view> | where sourceCategory matches \"something\" | sum(field) by sourceCategory

This works just fine in the Sumo GUI. I get a field in result called "_sum" which gives me the desired result.

However the same doesn't work when I do it using the SUMO APIs. If I create a job with this body:

{
    "query": "_view = <some_view> | where sourceCategory matches "something" | sum(field) by sourceCategory",
    "from": "start_timestamp",
    "to": "end_timestamp",
    "timeZone": "some_timezone"
}

I call the "v1/search/jobs" POST method with the above body and I do GET "v1/search/jobs/{job_id}" till the state is "DONE GATHERING RESULTS". Then I do "v1/search/jobs/{job_id}/messages". I was expecting to see aggregated values in the result, but instead I see something similar to:

{
   "fields":[
      {
         "name":"_messageid",
         "fieldType":"long",
         "keyField":false
      }, ...
   ],
   "messages":[
      {
         "map":{
            "_receipttime":"1359407350899",            
            "_size":"549",
            "_sourcecategory":"service",
            "_sourceid":"1640",
            "the_field_i_mentioned":"not-aggregated-value"
            "_messagecount":"2044"
         }
      }, ...
   ]
]

Thanks for going through my question. Any advices / work-arounds are appreciated. I don't really want to iterate manually through all items and calculate the sum. I'd prefer to do it on SumoLogic side itself. Thanks Again!

Solution

  • Explanation

    Similar as in the User Interface, in the API for log searches you get both raw results (also referred to as messages) and the aggregate results (also referred to as records). enter image description here

    (Obviously, the latter are only returned if there's any aggregation in the query. In your case there is.)

    Actual suggestion

    Then I do "v1/search/jobs/{job_id}/messages"

    Try /records instead.

    See the docs for "Paging through the records found by a Search Job"

    Disclaimer: I am currently employed by Sumo Logic.