Is it possible to use literal data as stream source in Sumologic?

Question

Is it possible for a Sumologic user to define data source values inside a Query and use it in subquery condition?

For example in SQL, one can use literal data as source table.

-- example in MySQL
SELECT * FROM (
  SELECT 1 as `id`, 'Alice' as `name`
  UNION ALL
  SELECT 2 as `id`, 'Bob' as `name`
  -- ...
) as literal_table

I wonder if Sumo logic also have such kind of functionality.

I believe combining such literal with subqueries would make user's life easier.

score 1 · Answer 1 · answered Jan 15 '20 at 15:33

I believe the equivalent in a Sumo Logic query would be combining the save operator to create a lookup table in a subquery: https://help.sumologic.com/05Search/Subqueries#Reference_data_from_child_query_using_save_and_lookup

Basically something like this:

_sourceCategory=katta
 [subquery:(_sourceCategory=stream explainJSONPlan.ETT) error
      | where !(statusmessage="Finished successfully" or statusmessage="Query canceled" or isNull(statusMessage))
      | count by sessionId, statusMessage
      | fields -_count
      | save /explainPlan/neededSessions
      | compose sessionId keywords]
| parse "[sessionId=*]" as sessionId
| lookup statusMessage from /explainPlan/neededSessions on sessionid=sessionid

Where /explainPlan/neededSessions is your literal data table that you select from later on in the query (using lookup).

score 0 · Answer 2 · answered Jan 17 '20 at 22:07

You can define a lookup table with some static map/dictionary you update not so often (you can even point to a file in the internet in case you change the mapping often).

And then you can use the |lookup operator. It's nothing special for subqueries.

Disclaimer: I am currently employed by Sumo Logic.

Is it possible to use literal data as stream source in Sumologic?

2 Answers2