Sumologic query to show data by date

user_19656663 0
Viewed 36

I have created Sumologic dashboard to show some errors in the application. What I want is show the error per date. It show the error but it doesn't aggregate the same error messages as the messages have some GUID. This is the sample part of the query:

_sourceCategory="playGames/web-app-us"
and ERR
| timeslice 1d
| count _timeslice, message

enter image description here

sumologic dashboard
1 Answers

I believe you need to format the message and remove the GUID. So all the messages with GUID will be aggregate to single message. You can use regex to format the messages and remove the GUID. The sample query look like this and use as needed. The sample error message is like this

Error occurred. Exception: System.Exception: my custom error message: 1121fd05-065b-499f-b174-2a13efdaf8b5

And the Sumologic query

_sourceCategory="dev/test-app"
and "[Error]"
and "Error occurred"
// | timeslice 1d
| formatDate(_receiptTime, "yyyy-MM-dd") as date
| replace(_raw,/my custom error message: ([0-9A-Fa-f\-]{36})/,"my custom error message") as finalMessage
| count date, finalMessage
| transpose row date column finalMessage

This video shows step by step guidance. https://youtu.be/Nxzp7G-rUh8

enter image description here

user_189185860
Related