Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added views docs #4522

Open
wants to merge 47 commits into
base: main
Choose a base branch
from
Open

Added views docs #4522

wants to merge 47 commits into from

Conversation

JV0812
Copy link
Collaborator

@JV0812 JV0812 commented Sep 11, 2024

Purpose of this pull request

This pull request is to add the Views docs.

Select the type of change

  • Minor Changes - Typos, formatting, slight revisions
  • Update Content - Revisions, updating sections
  • New Content - New features, sections, pages, tutorials
  • Site and Tools - .clabot, version updates, maintenance, dependencies, new packages for the site (Docusaurus, Gatsby, React, etc.)

Ticket (if applicable)

Documentation for new Views page instead of existing Scheduled Page

@cla-bot cla-bot bot added the cla-signed Contributor approved, listed in .clabot file label Sep 11, 2024
@JV0812 JV0812 marked this pull request as draft September 11, 2024 06:45
@JV0812 JV0812 self-assigned this Sep 11, 2024
@JV0812 JV0812 added the do-not-merge Pull requests that should not be merged label Sep 11, 2024
cid-redirects.json Outdated Show resolved Hide resolved
cid-redirects.json Outdated Show resolved Hide resolved
sidebars.ts Outdated Show resolved Hide resolved
@kimsauce kimsauce self-requested a review September 17, 2024 17:50
cid-redirects.json Outdated Show resolved Hide resolved
cid-redirects.json Outdated Show resolved Hide resolved
cid-redirects.json Outdated Show resolved Hide resolved
cid-redirects.json Outdated Show resolved Hide resolved
Comment on lines +21 to +24
You can forward log data from a [Partition](/docs/manage/partitions) or [Views](/docs/manage/views) to an S3 bucket. Only new data is forwarded from a Partition once it is set to forward data. 

After data forwarding is configured, you should start to see file objects posted within your configured bucket. If your Scheduled View conducts aggregation, which is a best practice, your aggregate fields are automatically appended to the forwarded objects.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
You can forward log data from a [Partition](/docs/manage/partitions) or [Views](/docs/manage/views) to an S3 bucket. Only new data is forwarded from a Partition once it is set to forward data. 
After data forwarding is configured, you should start to see file objects posted within your configured bucket. If your Scheduled View conducts aggregation, which is a best practice, your aggregate fields are automatically appended to the forwarded objects.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove these paragraphs because they repeat text from the beginning of the article.

@@ -8,7 +8,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';

<img src={useBaseUrl('img/icons/operations/send-data.png')} alt="Document with a forward symbol icon" width="50"/>

Data Forwarding allows you to forward log data to an external server or supported storage service. You can forward log data to an AWS S3 bucket through [Partitions](/docs/manage/partitions) or [Scheduled Views](/docs/manage/scheduled-views). See [Forwarding Data from Sumo Logic to S3](/docs/manage/data-forwarding/amazon-s3-bucket/) for details.
Data Forwarding allows you to forward log data to an external server or supported storage service. You can forward log data to an AWS S3 bucket through [Partitions](/docs/manage/partitions) or [Views](/docs/manage/views). See [Forwarding Data from Sumo Logic to S3](amazon-s3-bucket.md) for details.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Data Forwarding allows you to forward log data to an external server or supported storage service. You can forward log data to an AWS S3 bucket through [Partitions](/docs/manage/partitions) or [Views](/docs/manage/views). See [Forwarding Data from Sumo Logic to S3](amazon-s3-bucket.md) for details.
Data Forwarding allows you to forward log data to an external server or supported storage service. You can forward log data to an AWS S3 bucket through [Partitions](/docs/manage/partitions) or [Scheduled Views](/docs/manage/views/scheduled-views). See [Forwarding Data from Sumo Logic to S3](amazon-s3-bucket.md) for details.

@@ -61,7 +61,7 @@ _index=sumologic_audit_events _sourceCategory=accessKeys
| [Password Policy](/docs/manage/security/set-password-policy) | `passwordPolicy` |
| [Roles](/docs/manage/users-roles/roles/create-manage-roles) | `roles` |
| [SAML](/docs/manage/security/saml) | `saml` |
| [Scheduled Views](/docs/manage/scheduled-views) | `scheduledView` |
| [Scheduled Views](/docs/manage/views) | `scheduledView` |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| [Scheduled Views](/docs/manage/views) | `scheduledView` |
| [Scheduled Views](/docs/manage/views/scheduled-views) | `scheduledView` |

@@ -24,7 +24,7 @@ Following are the capabilities you can assign when you [create roles](create-ma
| Manage Apps | Install and manage [apps](/docs/integrations). |
| Manage Connections | Manage the [connections](/docs/alerts/webhook-connections/) that allow you to send alerts to other tools. |
| View Connections | View [connections](/docs/alerts/webhook-connections/) on the **Connections** page. |
| View Scheduled Views | [View Scheduled Views](/docs/manage/scheduled-views).|
| View Scheduled Views | [View Scheduled Views](/docs/manage/views).|
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| View Scheduled Views | [View Scheduled Views](/docs/manage/views).|
| View Scheduled Views | [View Scheduled Views](/docs/manage/views/scheduled-views).|

```
## Should I create a Scheduled View or use Save to Index?

In most cases, if you can use a [Scheduled View](/docs/manage/views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
In most cases, if you can use a [Scheduled View](/docs/manage/views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this.
In most cases, if you can use a [Scheduled View](/docs/manage/views/scheduled-views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this.

<div className="box-wrapper">
<div className="box smallbox card">
<div className="container">
<a href="/docs/manage/views/scheduled-searches/add-schedule-search"><img src={useBaseUrl('img/icons/general/calendar.png')} alt="icon" width="40"/><h4>Create a Scheduled Search</h4></a>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<a href="/docs/manage/views/scheduled-searches/add-schedule-search"><img src={useBaseUrl('img/icons/general/calendar.png')} alt="icon" width="40"/><h4>Create a Scheduled Search</h4></a>
<a href="/docs/manage/views/scheduled-searches/add-schedule-search"><img src={useBaseUrl('img/icons/general/calendar.png')} alt="icon" width="40"/><h4>Add a Scheduled Search</h4></a>

The page has information about viewing information about the views/indexes configured for your organization.

:::note
You must have a role that grants you the View Scheduled Views [role capability](/docs/manage/views/view-list) in order to view information about scheduled views.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
You must have a role that grants you the View Scheduled Views [role capability](/docs/manage/views/view-list) in order to view information about scheduled views.
You must have a role that grants you the View Scheduled Views [role capability](/docs/manage/users-roles/roles/role-capabilities/) in order to view information about scheduled views.

@@ -7,4 +7,4 @@ Ingest Time FERs have the following limitations:
* Ingest Time rule expressions are limited to a maximum of 16k (16,384) characters.
* Ingest Time rules can extract up to a maximum of 16k (16,384) characters for each field.
* The cumulative size of all fields extracted by a rule for a message/event is limited to 64kb.
* Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/scheduled-views) to extract fields for your historical data.
* Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/views) to extract fields for your historical data.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/views) to extract fields for your historical data.
* Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/views/scheduled-views) to extract fields for your historical data.

@@ -24,7 +24,7 @@ When naming your index, use a name that's descriptive and easy to remember. Name

## Should I create a Scheduled View or use Save to Index?

In most cases, if you can use a [Scheduled View](/docs/manage/scheduled-views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this.
In most cases, if you can use a [Scheduled View](/docs/manage/views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
In most cases, if you can use a [Scheduled View](/docs/manage/views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this.
In most cases, if you can use a [Scheduled View](/docs/manage/views/scheduled-views) for your use case, this may be a better option, as Scheduled Views include many built in safeguards, as well as management features. If your search query needs to use operators that are restricted for Scheduled Views, saving your Scheduled Search results to an Index allows you to do this.

Copy link
Collaborator

@jpipkin1 jpipkin1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wow, that's a lot of great stuff, @JV0812! I have only a few minor suggestions, mostly having to do with linking.

JV0812 and others added 3 commits October 18, 2024 16:43
Co-authored-by: John Pipkin (Sumo Logic) <jpipkin@sumologic.com>
Co-authored-by: John Pipkin (Sumo Logic) <jpipkin@sumologic.com>
Co-authored-by: John Pipkin (Sumo Logic) <jpipkin@sumologic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cla-signed Contributor approved, listed in .clabot file do-not-merge Pull requests that should not be merged
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants