How do I add a custom filter to a log search? - sumologic

How do I create and add a custom placeholder/filter to a log search in sumologic?
In this example, how would I replace dev- with an ${env} placeholder that I can use as a filter in the dashboard I am creating.
_source="syslog-collector" "dev-my-app"
| parse "INFO : *" as jsonobject
| json field=jsonobject "load-time" as load_time
| timeslice 30m | pct(load_time, 99.9) as ms group by _timeslice

I used regex to parse an env variable which I then filtered on in my dashboard.
| parse regex "(?<env>(?<=.{20}).+?(?=-my-app))"

Related

Specflow: How to generate a unique string by ValueRetriever and store it for the current Scenario, without any issue in parallel execution

to make test data unique for correctly selecting in tests. I'm looking for solution to generate a unique string and replace it to the "(*)" in Feature file. The generated unique string should be remained to the end of the Scenario, and it's safe when tests are executed parallelly (each Scenario should hold its own unique string).
I currently generate the unique string by create a custom class UniqueStringRetriever : IValueRetriever but duno how to register it to avoid parallel execution problem.
Does anyone have idea for this situation please leave your help in here. I do appreciate that.
Background:
Given the following Customer
| First Name | Last Name |
| David (*) | Brown |
Scenario: Search Customer by First Name
When user search Customer by First Name
| First Name |
| David (*) |
Then the result list displays 'David (*)' customer

How to count and compare amount of regex matches

I want to use Sumo Logic to count how often different APIs are called. I want to have a table with API call name and value. My current query is like this:
_sourceCategory="my_category"
| parse regex "GET.+443 (?<getUserByUserId>/user/v1/)\d+" nodrop
| parse regex "GET.+443 (?<getUserByUserNumber>/user/v1/userNumber)\d+"
| count by getUserByUserId, getUserByUserNumber
This gets correct values but they go to different columns. When I have more variables, table becomes very wide and hard to read.
I figured it out, I need to use same group name for all rexexes. Like this:
_sourceCategory="my_category"
| parse regex "GET.+443 (?<endpoint>/user/v1/)\d+" nodrop
| parse regex "GET.+443 (?<endpoint>/user/v1/userNumber)\d+"
| count by endpoint

How to match scenario outline with in path parameter in a given clause BDD

I am struggling to get to match this in the step definitions, help please
When I perform a GET request using "/urlserver/custom/{<userID>}/address"
Then.....
Examples:
| userID |
| user1 |
| user2 |
I want to capture this when clause and then be able to pass the user id into a path parameter in the url.
You do not need the curly braces around the URL parameter:
When I perform a GET request using "/urlserver/custom/<userID>/address"
...
Note that {<userID>} will not work, but <userID> should.

Performing a search through database for value

I'm trying to use a search bar, to search for values in my Firebase Database. For example:
---users---
|
| ---1412512351--
| |
| |- name: Nick
| |- age: 37
|
| ---5734739374--
| |
| |- name: John
| |- age: 19
When the user finishes typing, and clicks done, I want to perform a search through the database and find the name that they are looking for. Instead of loading all of the users, which could take a while.
Also, I want to get all of the values close to the search. For example if it type "Nick", It should bring up a values close to that string, like Nicholas or Nathan etc.
Thanks in advance!
To find a particular user (in JS):
var usersRef = new Firebase("https://yourdb.firebaseio.com/users/");
var theNameIAmAfter = usersRef.orderByChild("name").equalTo(SearchByThisName);
Also, I want to get all of the values close to the search. For example
if it type "Nick", It should bring up a values close to that string,
like Nicholas or Nathan etc...
I'm not sure if that's doable with firebase.

How to get the first elements of COLLECT whithout limiting the global query?

In a twitter like app, I would like to get only the 3 last USERS which has PUBLISH a tweet for particular HASHTAG (A,B,C,D,E)
START me=node(X), hashtag=node(A,B,C,D,E)
MATCH n-[USED_IN]->tweet<-[p:PUBLISH]-user-[FRIEND_OF]->me
WITH p.date? AS date,hashtag,user ORDER BY date DESC
WITH hashtag, COLLECT(user.name) AS users
RETURN hashtag._id, users;
This is the result I get with this query. This is good but if the friend list is big, I could have a very large array in the second column.
+-------------------------------------------+
| hashtag | users |
+-------------------------------------------+
| "paradis" | ["Alexandre","Paul"] |
| "hello" | ["Paul"] |
| "public" | ["Alexandre"] |
+-------------------------------------------+
If I add a LIMIT clause, at the end of the query, the entire result set is limited.
Because a user can have a very large number of friends, I do not want to get back all those USER, but only the last 2 or 3 which has published in those hashtags
Is the any solution with filter/reduce to get what I expect?
Running neo4j 1.8.2
Accessing sub-collection will be worked on,
meanwhile you can use this workaround: http://console.neo4j.org/r/f7lmtk
start n=node(*)
where has(n.name)
with collect(n.name) as names
return reduce(a=[], x in names : a + filter(y in [x] : length(a)<2)) as two_names
Reduce is used to build up the result list in the aggregator
And filter is used instead of the conditional case ... when ... which is only available in 2.0
filter(y in [x] : length(a)<2) returns a list with the element when the condition is true and an empty list when the condition is false
adding that result to the accumulator with reduce builds up the list incrementally
Be careful, the new filter syntax is:
filter(x IN a.array WHERE length(x)= 3)

Resources