sumologic

Sumo Logic metric query override quantize rollup but leave default interval?


Can I override the quantize rollup (default avg) without overriding the interval? That way I can change the quantize rollup to say max but still have the dynamic interval inherited from the dashboard it's in.

E.g. quantize to inherited using max

Use Case

A category has 5 hosts. I want to know the max memory usage any host had during a quantized interval. And then I want the max of all hosts. So I might make a query like:

_sourceCategory=x metric=process.memory.usage process.executable.name=my-bin 
| quantize to 5m using max 
| max

But I want it to work in a dashboard so that the 5m is dynamic and not hard-coded.


Solution

  • You can use quantize using max to achieve this. This way you will use the max rollup, but with the default quantization granularity.

    Using the query from your example, it should look like this:

    _sourceCategory=x metric=process.memory.usage process.executable.name=my-bin 
    | quantize using max 
    | max