Timeslice 1m as my_time_bucket_field_nameįixed-size buckets of 1 minute each. The output field name is aliased to 2hrs.īucketing to 150 buckets over the search results.

The output field is default _timeslice.įixed-size buckets that are 2 hours long. So if the query is _sourceCategory=abc | timeslice 1m | count by _timeslice, the timeRange is 15m, and there are 15 rows in the query output, it would trigger the alert if _count for any row matches the threshold and resolve when none of the rows match the alert threshold (and all match resolution threshold).įixed-size buckets at 5 minutes. If there are multiple rows in the search query output because of timeslice or any other reason (such as a group by operator), it would match each row with the monitor threshold and if it matches for any row, it would trigger the alert. Monitor query output is matched with the configured threshold during its evaluation. If no time period or bucket is specified it defaults to the time range of the Search. Timeslice Limited is part of the Timeslice group which includes Timeslice (Legal Software), City Computers (Insurance Software) & Host My Cloud (Cloud Solutions).If you use timeslice with the compare or outlier operators, don't alias timeslice.For example, if your query specifies 150 buckets, Sumo Logic will find a reasonable clock-aligned resolution to return approximately 150 buckets in the query results. The number of buckets in your query is a target or maximum, not necessarily the exact number of buckets that will be returned.The timeslice operator must be used with an aggregating operator such as count by or group by.After you’ve timesliced the data into buckets, the transpose operator allows you to plot aggregated data in a time series. This means any data that varies over time, such as Actuals, Allocations, Availability, Baseline, Estimates, and Time Entries. The timeslice operator is commonly used in conjunction with the transpose operator. Timeslices - what are they Time Slices hold time-varying data.Creates a field named _timeslice_end that marks the end of the timeslice in milliseconds.

If an alias is not provided, a default _timeslice field is created that marks the start of the timeslice in milliseconds. An alias for the timeslice field is optional.

Timeslice environment