QuickStart your Sumo Logic service with this exclusive webinar. At these monthly live events you will learn how to capitalize on critical capabilities that can amplify your log analytics and monitoring experience while providing you with meaningful business and IT insights

1. Sumo Logic Confidential
QuickStart Webinar
Getting Started with Sumo Logic
Mario Sánchez
January 2016
Welcome.
To give everyone a
chance to successfully
connect, we’ll start at
10:05 AM Pacific.

2. Sumo Logic Confidential
Agenda
What is Sumo Logic?
Key Points Regarding Data Collection (Admin Topic)
Searching, Parsing and Analyzing Data
Visualizing and Monitoring – Dashboards and Alerts
Introduction to Library and Apps
Introduction to Optimization Tools(Admin Topic)

3. Sumo Logic Confidential
What is Sumo Logic?

4. Sumo Logic Confidential
Continuous Intelligence
DEVOPS IT INFRASTRUCTURE
AND OPERATIONS
COMPLIANCE AND
SECURITY
DEVOPS
Streamline
continuous delivery
Monitor KPI’s and
Metrics
Accelerate
Troubleshooting
IT INFRASTRUCTURE
AND OPERATIONS
Monitor all workloads
Troubleshoot and
increase uptime
Simplify, Modernize,
and save costs
COMPLIANCE AND
SECURITY
Automate and
demonstrate
compliance
Audit all systems
Think beyond rules
Sumo Logic Cloud Analytics Service

5. Sumo Logic Confidential
The Sumo Logic Service
DEVOPS
IT INFRASTRUCTURE
AND OPERATIONS
COMPLIANCE AND
SECURITY
Collect and Centralize: Effortlessly collect terabytes of data from anywhere
Search and Analyze: Run searches and correlate events in real-time
Detect and Predict: Detect outliers and deviations to uncover the unknowns
Monitor and Visualize: Easily monitor and visualize your data in real-time
Alert and Notify: Proactively notifies you when specific events are identified

6. Sumo Logic Confidential
Securing your Data
Compliance and Certifications on top of AWS Security:
• PCI/DSS 3.0 Service Provider Level 1 Certified
• SSAE 16 SOC Type 2 attestation
• HIPAA-HITECHcompliant
Expected certifications:
• ISO 27001
• CSA Star
Data Encryption:
• AES 256-bit encryption at rest
• TLS encryption in transit
Resource: https://www.sumologic.com/compliance

7. Sumo Logic Confidential
Enterprise Logs are Everywhere
Custom App
Code
Server / OS
Virtual
Databases
Network
Open Source
Middleware
Content
Delivery
IaaS,
PaaS
SaaS Security

8. Sumo Logic Confidential
High-Level Data Flow

9. Sumo Logic Confidential
Sumo Logic Data Flow
Data Collection Search & Analyze Visualize & Monitor
Alerts
Dashboards
Collectors
Sources
Operators
Detect
1 2 3

10. Sumo Logic Confidential
Data Collection

11. Sumo Logic Confidential
Host A
Collectors and Sources
Apache Access
Apache Error
Collector
A
Host B
Collector
B
Host C
Collector
C
Apache Access
Apache Error
IIS Logs
IIS W3C Logs

12. Sumo Logic Confidential
Metadata Fields
Name Description
_collector Name of the collector this data came from
_source Name of the source this data came through
_sourceHost Hostname of the server this data came from
_sourceName Name of the log file (including path)
_sourceCategory Category designation of source data
Tags added to your messages when data is collected
Host A
Apache Access
Apache Error
Collector
A

13. Sumo Logic Confidential
Host A
Metadata Field: Source Category
Apache Access
_sourceCategory =
WS/Apache/Access
Apache Error
_sourceCategory =
WS/Apache/Error
Collector
A
Host B
Collector
B
Host C
Collector
C
Apache Access
_sourceCategory =
WS/Apache/Access
Apache Error
_sourceCategory =
WS/Apache/Error
IIS Logs
_sourceCategory =
WS/IIS
IIS W3C Logs
_sourceCategory =
WS/IIS/W3C
Sample Searches for
_sourceCategory:
= WS/Apache/Access
= WS/Apache/*
= WS/*

14. Sumo Logic Confidential
Source Category Naming Convention
Simplifies Search Syntax and Scope Definitions
Used for other Sumo Logic features
Role-BasedAccess Control (Data Provisioning)
Partitioning (Search Optimization Tool)
Adopt a Robust Naming Convention Early
Ex: Prod/Sumo/Apache/Access à Env/Customer/Device/MessageType
Ex: OS/Windows/2012/Messages à Device/Vendor/Version/MessageType
Blog Post: GoodSourceCategory, Bad SourceCategory

15. Sumo Logic Confidential
Search and Analyze

16. Sumo Logic Confidential
Set your
Preferences
Set your Session
Timeout
Query Editing
versus Running

17. Sumo Logic Confidential
Search Basics Overview
Time Range
Histogram
Search Bar
Search Results
Display Options

18. Sumo Logic Confidential
Field Browser - Metadata fields
Sumo Logic Confidential
Field Browser
Metadata Fields
Parsed Fields

19. Sumo Logic Confidential
Search Structure
Keywordsand operators (separated by pipes) that build on top of each other
Syntax:
metadata tags + keywords| parse | filter | aggregate | sort | limit
Example Search:
Results
where
metadata
keyword

20. Sumo Logic Confidential
Keyword Search
Case Insensitive
Wildcard Support (e.g. ERR*)
Boolean Logic Support
AND
OR
!(A OR B)
Combine these keywords with metadata fields
Bloom filters
Using keywords helps bloom filters locate data very quickly

21. Sumo Logic Confidential
• Determine the data available through your search.
• Pre-populated Dropdown
– Last 15 min, Today
• Absolute
– 12:25PM 12:30PM
– 8/11/2015 13:00AM 8/11/2015 14:00AM
• Relative
– -5m
– -2h
– -2d -1d
Time Range

22. Sumo Logic Confidential
Develop Good Search Habits
Use metadata and keyword combinations to reduce scope
Add line breaks after each operation
Limit result sets before aggregating data à user=a | count by user
Use parse anchor instead of parse regex for structured messages
Avoid the use of expensive parse regex tokens like .* à d{2,10}
Narrow your time-range down as much as possible

23. Sumo Logic Confidential
Refining Results by Surrounding Messages

24. Sumo Logic Confidential
• LogReduce uses fuzzy logic and soft matching to cluster messages providing quick
investigation view into your environment.
Operators: Looking for the Unknown

25. Sumo Logic Confidential
• Identify unexpectedly high or low values within determined thresholds
|timeslice 1m
|count by _timeslice
|outlier _count
Operators: Finding Outliers

26. Sumo Logic Confidential
• Parsing enables a user to extract parts of a message and classify them as
fields.
– Enables you to perform additional operations
• Logical/conditional – based on values
• Mathematical – operations on value sets
• Parsing Options
– parse anchor: Leverages beginning and ending anchors
– parse regex: Extracts nested information via regex
Extracting and Labeling Additional Fields

27. Sumo Logic Confidential
Parse Anchor - Using the UI
Highlighting
strings in the
result allow
you to launch
the UI parser
UI Parser allows
you to select fields
and label them
Results now show
your parsed fields

28. Sumo Logic Confidential
• Extracts nested information via regular expressions
• Use if the construct of the messages is inconsistent
_sourceCategory=Apache/Access
| parse regex "[A-Z]+s(?<url>/S*)sHTTP/1.d+"s(?<status_code>d+)s"
Parse Regex

29. Sumo Logic Confidential
Regular Expressions – References and Resources
Regular Expressions use JRE
Online Resources:
• regex101.com
• Regular-expressions.info/refadv.html
• en.wikipedia.org/wiki/Regular_expression
• regexr.com
• Book
– Mastering Regular Expressions by Jeffrey E.F. Friedl

30. Sumo Logic Confidential
Evaluates messages and places them into groups
• Produces aggregates in a separate tab
• Must come after basic operators such as parse. Cannot be used with summarize.
• The count Operator enables you to group messages that match a classification
– Ex: _sourceCategory=Apache* | count as mycount
– Ex: GET | count by _sourceCategory
Grouping your Data

31. Sumo Logic Confidential
• Dissecting your result sets using Metadata Fields
– Ability to aggregate results sets and grouping them by metadata fields
• EX: _collector=*apache* | count by _sourceCategory
– Get a count of grouped result sets
• Ex: (Error OR fail*)| count by _sourcecategory , _sourcehost
– Organize Results by Count
• Ex: _collector=*apache*| count by _sourceCategory | sort by _count
Leveraging Metadata for Grouping

32. Sumo Logic Confidential
Timeslice operator enables you to segment your results
by time buckets
– Minute (timeslice by 5m)
– Hour (timeslice by 1h)
– Day (timeslice by 1d)
Example:
_sourceCategory=Apache/Access GET
|timeslice 1m
| count by _timeslice
| sort by _timeslice asc
Time-based Grouping

33. Sumo Logic Confidential
Saving Your Searches
Click Save As
under the Query
Window
Description is searchable,
so a include detail to allow
searching at a future time
You can save the search in
your own Personal folder, or
create a sub-folder

34. Sumo Logic Confidential
Visualize and Monitor

35. Sumo Logic Confidential
• Collection of Panels that provide graphical representation of data
– Each Panel processes results of a search
– Drilldown for additional analysis
• Drill into the query behind the dashboard
• Drill to another dashboard
Introduction to Dashboards

36. Sumo Logic Confidential
• Chart Types
– Table
– Bar
– Column
– Line
– Area
– Pie
– Box Plot
– Google Maps
– Single Value
Providing Context through Visualization

37. Sumo Logic Confidential
– Live Dashboards
• Provides a live stream of data
• No back filling of data
– Interactive Dashboards
• Search based (On-Demand)
• Backfilling of data
• Support Filtering
Dashboard Types
No
Interaction
Ability to use
Pre-defined
filters

38. Sumo Logic Confidential
Live Dashboards versus Interactive Dashboards
Use Case Examples Dashboard Type
Large screen
displays with
streaming updates
Shared Screens for NOC, Operations,
Developers, etc.
Live Dashboards
Template for
Exploring Data
Operational Investigations Interactive
Dashboards
Historical Reporting
and Investigation
Audits, Failed/successful logins for
certain groups
Interactive
Dashboards

39. Sumo Logic Confidential
Dashboards - Adding a Panel
1. Performyour
Search
2. Format your
Results
3. Create a Panel

40. Sumo Logic Confidential
Alerting
Using a Scheduled Search, you can set Alerts to trigger whenever the search completes
or when a certain condition is met.
Alert types include:
• Save to Index
• Script Action
• Email
• Webhooks
Blog Post: 2 Key Principles for Creating Meaningful Alerts

41. Sumo Logic Confidential
Saving and Scheduling an Alert
1. Save your Search
2. Schedule the
Search
3. Specify frequency and time range
4. Specify Alert condition &
threshold
5. Specify Alert Type and details

42. Sumo Logic Confidential
Jumpstart with Apps

43. Sumo Logic Confidential
Installing Applications

44. Sumo Logic Confidential
Optimizing Your Search
Experience

45. Sumo Logic Confidential
Factors in Search Performance
Query Structure
Time range
Data Selectivity (keywords, metadata, where statements)
Heavy Operations (join, transaction, summarize)
Overall Data Volume
System load
Improve search experience using Optimization Tools

46. Sumo Logic Confidential
Search Optimization Tools
How-To Webinar Recording: https://youtu.be/JNWbtws-sns
Partitions
Index data for searching over a smaller data set
Scheduled Views
Pre-aggregating data for fast counts/sums over longer time ranges
Field Extraction Rules
Parse the data on ingest rather than run-time; simplifies searches
Take advantage of interactive dashboard filters

47. Sumo Logic Confidential
Questions?
Additional Resources
Search Online Documentation
Search/Post to Community Forums
Search, post, respond
Submit/vote for feature requests
Submit Tips & Tricks
Open a Support Case
Sumo Logic Services
Customer Success,Professional Services,Training

48. Sumo Logic Confidential
Helpful Links
Hands-on Lab: Sumo Logic QuickStart Tutorial
https://service.sumologic.com/help/Default.htm#Tutorial.htm?Highlight=tutorial
Sumo Logic Training
https://www.sumologic.com/training
Support Portal, Documentation, Community Forums, Feature Requests
https://support.sumologic.com/home
Resources (Whitepapers, videos, screencasts)
https://www.sumologic.com/resource
Services
customer-success@sumologic.com

49. Sumo Logic Confidential
Thank you!