Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cid-redirects.json
Original file line number Diff line number Diff line change
Expand Up @@ -385,6 +385,7 @@
"/05Search/Get-Started-with-Search/How-to-Build-a-Search/Best-Practices%3A-Search-Rules-to-Live-By": "/docs/search/get-started-with-search/build-search/best-practices-search",
"/05Search/Get-Started-with-Search/How-to-Build-a-Search/Dynamic_Parsing": "/docs/search/get-started-with-search/build-search/dynamic-parsing",
"/05Search/Get-Started-with-Search/How-to-Build-a-Search/Keyword-Search-Expressions": "/docs/search/get-started-with-search/build-search/keyword-search-expressions",
"/docs/search/get-started-with-search/build-search/intelliparse-beta": "/docs/search/get-started-with-search/build-search/dynamic-parsing",
"/05Search/Get-Started-with-Search/How-to-Build-a-Search/Search-Syntax-Overview": "/docs/search/get-started-with-search/build-search/search-syntax-overview",
"/05Search/Get-Started-with-Search/How-to-Build-a-Search/Search-Templates": "/docs/search/get-started-with-search/build-search/search-templates",
"/05Search/Get-Started-with-Search/How-to-Build-a-Search/Set-the-Time-Range": "/docs/search/get-started-with-search/build-search/set-time-range",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,18 +6,6 @@ description: Dynamic Parsing (Auto Parse Mode) allows you to configure automatic

import useBaseUrl from '@docusaurus/useBaseUrl';

<!-- When Intelliparse goes GA, add a note here and in that doc differentiating it from Auto Parse.
Logs currently have two parsing modes:
Manual mode:
Nothing is automatically parsed
Autoparse mode:
Json blocks within logs are automatically parsed
We’re adding a third mode:
Intelliparse Mode:
Json blocks within logs are automatically parsed
Unstructured logs are parsed via pre-discovered parsers
-->

Dynamic Parsing (Auto Parse Mode) allows automatic field extraction from your JSON log messages when you run a search. This allows you to view fields from JSON logs without having to manually specify parsing logic.

## How Dynamic Parsing works
Expand Down Expand Up @@ -59,7 +47,7 @@ To optimize search performance you can manually set up Dynamic Parsing by defin

Run Time FERs have a scope, exactly like an Ingest Time FER, that defines which searches are applicable to Dynamic Parsing **Auto Parse Mode**. For Dynamic Parsing to work your query needs to have a scope that is defined in a Run Time FER, otherwise **Auto Parse Mode** will not be applicable.

1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**.
1. Click **+ Add** at top right of the table to create an FER.<br/> ![Create Field extraction rule with dynamic parsing.png](/img/search/get-started-search/build-search/dynamic-parsing/create-FER-dynamic-parsing.png)
1. Enter the following options:
* **Rule Name**. Type a name that makes it easy to identify the rule.
Expand Down Expand Up @@ -108,7 +96,7 @@ The [field browser](/docs/search/get-started-with-search/search-page/field-brows

## Using Manual mode

When **Auto Parse Mode** is disabled, you'll be in manual mode, meaning:
When **Auto Parse Mode** is disabled, you'll be in manual parsing mode, meaning:
* Fields won't be parsed automatically unless defined by an Ingest-Time FER.
* You'll need to add parsing logic manually.
* This mode is best suited for advanced users who want full control and optimized performance.
Expand Down

This file was deleted.

Original file line number Diff line number Diff line change
Expand Up @@ -6,18 +6,6 @@ description: Enable the Use Receipt Time feature to display search results in th

import useBaseUrl from '@docusaurus/useBaseUrl';

<!-- When Intelliparse goes GA, update this doc to reflect new Search Config...

Parsing
* Intelliparse
* Auto Parse
* Manual

Timestamp
* Message Time
* Receipt Time
-->

By default, log searches run by Message time. Enable the **Use Receipt Time** setting to run the search by Receipt time, which is the timestamp when a log message hits the Sumo Logic receivers.

To search data based on the order that Collectors received the messages use **Receipt Time**. This option has the search reference the [metadata](../search-basics/built-in-metadata.md) field `_receiptTime` instead of `_messageTime`, giving you the ability to view the difference in the parsed [timestamp](/docs/send-data/reference-information/time-reference) (`_messageTime`) and receipt time (`_receiptTime`) to pinpoint Sources that may be parsing the message's timestamps incorrectly.
Expand Down
5 changes: 0 additions & 5 deletions docs/search/mobot-unstructured-logs-beta.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,6 @@ At this stage, Mobot prioritizes unstructured logs that are already used in dash
* **Performance and reliability**. Response times and suggestion accuracy are consistent with Mobot’s structured log experience.
* **Security and compliance**. The same strict data handling and privacy standards apply. Unstructured Logs Support builds on Mobot’s secure foundation.

<!---No need to call it out until GA
### Powered by Intelliparse mode
Unstructured Logs Support is powered by [Intelliparse mode (Beta)](/docs/search/get-started-with-search/build-search/intelliparse-beta), a new parsing engine that automatically extracts fields from raw logs based on patterns already used in your dashboards. This eliminates the need for manual Field Extraction Rules (FERs) and allows Mobot to surface insights from unstructured logs out-of-the-box. Behind the scenes, Mobot injects a hidden `intelliparse` operator into relevant queries to make unstructured logs easier to work with.
-->

### Common use cases

* **General log exploration**. Ask questions about unstructured logs that are already used in your dashboards, even if they lack predefined fields.
Expand Down