Scheduled Search FAQs
The following topics include frequently asked questions about scheduled searches and provide troubleshooting tips.
In this section, we will introduce the following concepts:
📄️ Does Sumo Logic let me get alerts from a specific static IP address?
Yes, Sumo Logic provides webhook notifications through static IP addresses. You can allowlist those IP addresses to receive notifications directly from Sumo Logic. For a list of our allowlist addresses, contact Support.
📄️ Create an Email Alert to Notify you when Data Usage Reaches 90 Percent of your Account Limit
I want to create an email alert that lets me know when I reach 90% of data usage on my account, so I’m notified before I reach my account limit. What’s the best way to do this?
📄️ Why Would a Scheduled Search Fail?
A Scheduled Search may fail and be suspended for several reasons falling into three general areas.
📄️ How to Prevent your Scheduled Search from Timing Out
Before you create a scheduled search, be aware that Sumo Logic will not allow the scheduled search to run indefinitely. At some point, the query will be timed out to protect the reliability of the service.
📄️ Real Time Alert with greater than 1,000 results
Scheduled Search alert condition thresholds are based on the number of rows returned in your search results. It does not consider any values that may be present within a column of those rows. If your query does not perform any aggregations the Scheduled Search threshold will apply to the number of raw messages returned with a query, as seen under the Messages tab of the search. If a query contains an aggregate operation, for example, count, sum, min, max, etc... the Scheduled Search threshold will be applied to the number of aggregate rows returned by the query, as seen within the Aggregate tab of the results.
📄️ Service Alert: Scheduled Search Email Quota Reached for Search
Why do I receive the following email?
📄️ What Happens When a Scheduled Search Is Suspended?
If you have received an Alert Email from Sumo Logic stating that an issue has been detected with a Scheduled Search, it might not be immediately apparent why your Scheduled Search has failed, and may even be suspended. The Scheduled Search referred to in the email may be one that has run for months without a problem, but now for some reason, it fails.