Sumo Logic QuickStart Webinar Oct 2016

Editor's Notes

• #2: Welcome everyone to Sumo Logic’s Quickstart Webinar. My name is …. And I am … My goal today is to provide you with basic understanding of the Sumo logic Service and how it can help you uncover events that were difficult to do with simple searches and greps. Before we get started, some let’s cover some housekeeping items: - To avoid distractions, all Participants are muted - If you want to ask a question, feel free to use the GoToWebinar panel - Slides and a recording of this webinar will be shared
• #3: Given that we have quite a few beginners, we will start with a high-level view and then dive into details. We will start with.. (review entire agenda) - Although we will cover a few slides, most of this webinar will be done through a demo (a specific use case related to web servers) – reviewing the recording will allow you to follow along in your environment with your own data. Note that Tips and Tricks and Best Practices will be scattered throughout the presentation
• #4: Sumo Logic helps you gain insights into the growing pool of data within your complex environment. We help you gain visibility across DevOps, IT Ops and Compliance and Security environments.
• #5: Most of you are using the Sumo Logic service for at least one of the 3 following use cases: For DevOps –allows DevOps teams to monitor KPI’s to deliver quality software; less time troubleshooting and more time developing code. For IT Ops – Extract valuable information such as latencies, performance metrics, trends and any critical events tied with core systems. For Compliance and Security – Sumo Logic helps organizations simplify and automate compliance & security monitoring across their entire stack, using predictive analytics
• #6: Because we are a cloud-native solution, securing your data is extremely important to us. These are some of the certifications we hold. Note that this are on top of any AWS security certifications. Sumo Logic is the most thoroughly audited SaaS provider in the analytics space. We are more akin to an organization that harbors government data, than a normal technology company. Below is a link that gives you ore detail of each certification achieved.
• #7: What data can we ingest? We can ingest data from just about any source you can imagine - structured or unstructured. Here are just a few of the devices, applications and frameworks you may be using - all of which produce log data that SL can analyze. The left hands side can present you technology stack – from custom application code all the way down to your network devices. Sumo Logic has hired a few people from these organizations to expand our domain expertise in these areas.
• #9: Sumo Logic Data Flow is broken into 3 main areas: Data Collection through configurable Collectors and Sources. Collectors collect, compress, cache and encrypt the data for secure transfer. Search and Analyze – Users can run searches and correlate events in real-time across the entire application stack. We will be spending most of our time in this area during this webinar, as this is most likely what you will first be doing as a new user. Visualize and Monitor- Users have the ability to create custom dashboards to help you easily monitor your data in real-time. Custom alerts notify you when specific events are identified across your stack. I will cover Data Collection at a high-level, and cover the next 2 areas through a demo.
• #11: This is an great example what we see at a typical customer. This customer is sending web server log files to the Sumo Logic service. Host A and Host B are each sending a couple of log files through a locally installed Sumo Logic collector. In the case of Host C, which is sending IIS log files, it’s using a hosted collector where a local script in Host C can send data to an HTTP endpoint (running curl and POST commands). Hosted collectors are also able to load data from AWS S3 buckets. For instructor: Demo how to search help for “collector types” The great news for this customer is that they can centralize all their webserver logs, and start searching across all logs, or just Apache logs, or just Host B logs.
• #12: Great, data is ingested into the Sumo Logic service, but something else is also happening in the background. Every single message ingested gets tagged with metadata that makes it much easier to search for related messages. This table shows the 5 main tags (review them all) In particular, I want to point out the source Category metadata field, as choosing the right naming convention can make a big impact on your searching capabilities and performance.
• #13: This example will highlight the importance of defining the proper source category: Notice I’ve added the desired SourceCategory for each Source: = WS/Apache/Access Searches across Apache Security logs in both Host A and Host B = WS/Apache/* Searches across all Apache sources in both Host A and Host B = WS/* Searches across all Web Servers across all hosts
• #14: Source Categories are very powerful, and adopting a robust naming convention early is key to simplify your searches and scope definitions. Source Category is also used in other areas of our service, for example, for restricting or granting data access to users and roles, or for optimizing searches through partitions (which we will talk about later in this webinar)
• #15: The second area of Data flow is Search and Analyze. I will jump into a demo to show you more detail of how this can be done.
• #19: The combination of metadata and keywords reflect the search of your scope. This is what we’re going to talk a little bit more about in the next few slides. It’s very important that you be very selective about the data you’ll be searching through.
• #20: You’ll also want to include keywords as part of your search scope. Architecture discussions – show how the searches work in the backend
• #22: Plug for regex101. 
• #23: Surrounding messages allow you to investigate events surrounding a message from the context of the Host, file name or category identified enabling you to view the activity for the defined time period.
• #24: Introduce LogReduce Here we see the search “ (Error OR fail*)” returns 99 pages of error results, which can be cumbersome to go through. What you can do is click on the LogReduce button to invoke the Sumo Logic log reduce technology via the summarize operator to automatically find patterns in your logs and reduce this result set to a single page.
• #25: Demo the outlier operator Timeslices are required Adjustable variables allow you to get the right sensitivity Threshold Number of rolling stddev above/below the moving average Default: 3 Consecutive Number of consecutive points above/below the threshold to trigger Default: 1 Direction Detect high values, low values or both Default: Both Window Number of trailing timeslices used to calculate Default: 10
• #26: Need Identify Specific value you want to extract It enables you to perform additional operations Logical/Conditional – based on values Mathematical - Ways of defining fields Parse Anchor: is used to extract a string based on start and stop anchor points, and then to alias the extracted string as a user-created field. Parse Regex: or Extract, uses regular expressions to extract more complex or nested information as aliased fields.
• #27: Walk through screenshots for defining one field
• #28: We add the [A-Z]+ to denote all uppercase HTTP methods like GET, POST, CONNECT, PUT, DELETE etc. Also we make sure we are capturing a URL but specifying the starting character is a / and that it has one or more non-white space chars in it followed by a HTTP/1.\d+ word.
• #31: Now that u have your data, whats next. See how your data is segmented – you can do this by grouping / Dissecting your result sets using meta data fields Example: Counting by _sourceCategory Introduce concept of count Example: count on no groups Get a count of grouped result sets Example: Group by one group (category) Many _sourcecategory and host Include the underscore before the field name (sort by _count)
• #32: Now that u have your data, whats next. See how your data is segmented – you can do this by grouping / Dissecting your result sets using meta data fields Example: Counting by _sourceCategory Introduce concept of count Example: count on no groups Get a count of grouped result sets Example: Group by one group (category) Many _sourcecategory and host Include the underscore before the field name (sort by _count)
• #36: Different ways of seeing the same data in Interactive Search