diff --git a/cid-redirects.json b/cid-redirects.json index abc6bd8aa1..0eef95bdd7 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -1591,6 +1591,7 @@ "/cid/100000": "/docs/manage/deletion-requests", "/cid/100001": "/docs/search/get-started-with-search/build-search/search-templates", "/cid/100002": "/docs/search/copilot", + "/cid/100003": "/docs/search/mobot-multiturn-beta", "/cid/100004": "/docs/search/get-started-with-search/build-search/keyword-search-expressions", "/cid/100005": "/docs/get-started/sign-up", "/cid/100006": "/docs/get-started/library", diff --git a/docs/search/mobot-multiturn-beta.md b/docs/search/mobot-multiturn-beta.md new file mode 100644 index 0000000000..63e2a957f1 --- /dev/null +++ b/docs/search/mobot-multiturn-beta.md @@ -0,0 +1,129 @@ +--- +id: mobot-multiturn-beta +title: Sumo Logic Mobot Multi-turn Conversations (Beta) +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + + + + + +

Beta

+ +:::info +This feature is in Beta. For more information, contact your Sumo Logic account executive. +::: + +Our new conversational experience in Sumo Logic Mobot (formerly known as Copilot) lets you interact with queries the way you would with a chat assistant. You ask a question and can refine it with follow-ups, change units, and see the updated query and visualization without starting over. Mobot maintains your intent across turns, surfaces helpful suggestions, and makes it easy to explore related angles. This guide explains what's new in the UI, how the multi-turn flow works, and shows example workflows. + +## What's new in Beta + +* **Multi-turn conversations**. Refine queries through natural, conversational follow-up questions without losing context. +* **Improved accuracy**. Translations to Sumo Query Language are more reliable, especially for data sources with active dashboards. +* **Clarifications when needed**. If your request is ambiguous, Mobot may ask a follow-up question to narrow intent. +* **Smarter error handling**. Instead of generic errors, Mobot provides clearer messages and fallback suggestions for next steps. +* **Dashboard-aware translations (via Retrieval-Augmented Generation, or RAG)**. Mobot leverages queries from dashboards opened in your org in the last 90 days to better understand intent. +* **Guided exploration**. Intent cards summarize your current goal, and suggestion cards offer refinements you can apply with a click. +* **Integrated workflow**. A conversation pane shows your prompts and refinements, with queries rendered directly in the editor, live results, and the ability to branch or revisit past conversations. + +## Example workflow + +In the below example, we'll use the following key concepts: + +* **Multi-turn conversation**. A sequence of related instructions that retains context and incrementally updates the query and output. +* **Intent card**. Visual summary of what you're asking Mobot to do in this session. +* **Suggestion cards**. Recommended refinements or adjacent analyses you can apply with a click. + +This example workflow demonstrates the multi-turn interaction pattern; you can apply the same steps to other logs, events, or dimensions. + +### Step 1: Ask your initial question + +Start broad when you set a goal. We'll ask: `Show failed login attempts in the last 24 hours`. + +An intent card appears in the conversation pane that summarizes your goal. Mobot also surfaces suggestion cards with related refinements you can click, and gives you the option to open the query in Log Search. + +Mobot multi-turn conversation showing initial query, failed login attempts in the last 24 hours + +### Step 2: Narrow the scope + +The top reason in the table is `FailedScheduling`, so we'll select a follow-up suggestion, `Show failed scheduling events`. Mobot refreshes the results and updates the intent card and query to reflect the new focus. + +Mobot multi-turn conversation showing refinement, failed scheduling events + +Now, refine further by typing: `Break down failed scheduling events by namespace` + +Mobot multi-turn conversation showing refinement, failed scheduling events by namespace + +Mobot adjusts the query, applies the refinements, and renders a visual chart. + +### Step 3: Drill into causes + +Next, type `Add error messages`. Mobot translates this into: `Add error messages to the breakdown of failed scheduling events by namespace`. The intent card expands to include the new scope, and results now show error message details. + +Mobot multi-turn conversation showing error messages + +### Step 4: Request a trend over time + +Finally, type: `Show the trend over 24 hours`. Mobot translates this into: `Show the trend of failed scheduling events by namespace with error messages over 24 hours`. The query applies a timeslice (for example, one-hour buckets) to group results over time. + +Mobot multi-turn conversation showing trend over time + +Mobot also presents new suggestion cards to help you pivot into related questions, such as analyzing trends of event reasons or identifying top namespaces. + +### Next steps + +As with legacy Mobot, you can adjust the [time range](/docs/search/copilot/#time-range), switch to a different [chart type](/docs/search/copilot/#chart-type), or make other refinements. For example, in the previous step, where the results appear in a table view, you can change the visualization to a time-series chart (for example, line or area) to see the trend more clearly over time. + +You can also [edit the query logic](/docs/search/copilot/#edit-query-code), [open in Log Search](/docs/search/copilot/#step-4-open-in-log-search), or start over with a [new chat](/docs/search/copilot/#new-conversation). + +## Best practices + +* **Talk to it like a conversation**. Layer refinements instead of rewriting the whole question. +* **Be specific**. Combine filters, units, and percentiles in clear language. +* **Ask about data tied to dashboards**. Mobot works best when you reference data sources that already have dashboards built on them. +* **Use suggestions**. Leverage the surfaced cards to pivot or drill down without manual query construction. +* **Reuse history**. Open prior conversations to compare or branch analyses. + +## FAQ + +The questions below refer specifically to the multi-turn conversion (beta) experience. For general information about Mobot, see the [Mobot FAQ](/docs/search/copilot#faq). + +
+Is any user or org data sent outside our environment? + +No. All processing happens within your region's cluster. RAG context is scoped to dashboards in your own org—no cross-org data leakage. +
+ +
+What's the impact on query latency? + +Typical end-to-end response time remains under 2 seconds for most queries. Very large result sets or percentile calculations over broad ranges may take up to 5 seconds. During Beta, full query generation may take 6 to 7 seconds, but Mobot streams the first token (intent interpretation) within 2 seconds. +
+ +
+How do I debug a failed translation? + +If a translation fails, Mobot generates a contextual error message tailored to the situation. The message includes the generated query, explains why it failed, and suggests how to fix it (for example, `Try narrowing your time window` or `Simplify your filter expression`). + +Here are some common cases: + +* **No or delayed results**. Give Mobot a few seconds to process complex refinements. +* **Output too broad**. Add more context (for example, specify a client or namespace). +* **Unexpected numbers**. If results look off, be more explicit. For example, ask `show in milliseconds` or `convert to seconds` to adjust units, or say `show P90` / `switch back to P50 over 1 minute` to refine percentiles. +
+ +
+What are the current limitations? + +* For dashboard-aware translations via RAG, support is limited to the `sourceCategory` filter (selection in the source picker) at launch. Other expressions like `_index=` or `_sourceHost=` are not yet supported. +* RAG only considers dashboards that have been opened in the last 90 days when interpreting your query. +* Very large or highly complex queries may time out or trigger structured fallback responses. +* Multi-turn Mobot is available for log-based searches only. Metrics and Metric Searches are not supported in this Beta. +
+ +## Additional resources + +* [Mobot (formerly known as Copilot)](/docs/search/copilot) +* [Search Query Language](/docs/search/search-query-language) +* [Dashboards](/docs/dashboards) diff --git a/static/img/search/copilot/drill-causes.png b/static/img/search/copilot/drill-causes.png new file mode 100644 index 0000000000..a3643a4410 Binary files /dev/null and b/static/img/search/copilot/drill-causes.png differ diff --git a/static/img/search/copilot/initial-question.png b/static/img/search/copilot/initial-question.png new file mode 100644 index 0000000000..93b2f6c208 Binary files /dev/null and b/static/img/search/copilot/initial-question.png differ diff --git a/static/img/search/copilot/narrow-scope-filter.png b/static/img/search/copilot/narrow-scope-filter.png new file mode 100644 index 0000000000..cdb6c3642e Binary files /dev/null and b/static/img/search/copilot/narrow-scope-filter.png differ diff --git a/static/img/search/copilot/narrow-scope.png b/static/img/search/copilot/narrow-scope.png new file mode 100644 index 0000000000..9f362e2343 Binary files /dev/null and b/static/img/search/copilot/narrow-scope.png differ diff --git a/static/img/search/copilot/trend-over-time.png b/static/img/search/copilot/trend-over-time.png new file mode 100644 index 0000000000..fdda6ef31b Binary files /dev/null and b/static/img/search/copilot/trend-over-time.png differ