Every single day, the Sumo Logic Platform analyzes more than four exabytes of log data. The good news? The answers to your application performance, infrastructure health, and security incidents are hidden in those logs. The challenge? Historically, uncovering those answers required query language fluency.
That’s why we built Mobot, our conversational interface that connects users to advanced AI capabilities using natural language.
When we introduced the first iteration of Mobot, it transformed how our users interacted with their data. By translating natural language into precise queries, it broke down technical barriers and proved that AI could radically accelerate search workflows. It was a massive step forward, but it was just the start.
As teams began using Mobot daily, we saw how they could benefit from AI that could help them think through the data, not just search it. So we set out to evolve Mobot from a search assistant into a collaborative log analysis partner.
Today, we’re thrilled to announce that the new, advanced Mobot is available in preview for Sumo Logic customers.
What makes the new Mobot experience better?
The new Mobot moves beyond query-first workflows, transforming into a collaborative thinking partner that drives your analysis forward.
Here are four key ways Mobot has evolved:
- Understands user intent: No more manually restructuring broad or incomplete prompts. Mobot now interprets your high-level intent, even when ambiguous, and will clarify or redirect rather than leaving you at a dead end.
- Drives multi-step analysis: Where the old Mobot was limited to writing a single query, the new version translates your complex questions into structured analytical steps. It handles multi-step workflows for troubleshooting and deep data exploration without requiring you to manually pivot your investigation.
- Gathers the right data: No more manually selecting agents, time ranges, and data sources. Mobot can now intelligently select the right data, infer time ranges, and apply domain context. It even leverages your historical queries and dashboards, speeding up data digging.
- Reasons across data: Mobot now applies advanced multi-step reasoning to synthesize findings and connect critical signals across disparate data sources and delivers structured results with suggested next steps.
How teams are using the new Mobot
Each day, our users are uncovering new ways that Mobot can take on some of the heavy lifting of log analysis. Because of Mobot’s advanced reasoning capabilities, you don’t have to spoon-feed it simple, isolated questions. You can ask complex, multi-turn questions all at once, or spread them out over a natural conversation as you and Mobot work through an issue together.
Below are a couple of our favorite examples of how teams are using Mobot to drastically cut down their mean time to resolution.
Example one: Error rate triage
Context: Getting a fast triage view across all services is the first step any on-call engineer takes when something feels wrong or an alert fires. Without Mobot, engineers have to open dashboards for each service individually, write a dedicated query per service, and mentally aggregate the data. This requires knowing exactly which services to look at in advance and can take up to 30 minutes just to get a ranked, cross-service view.
Starting prompt: “Show me services with the highest error rates in the last hour.”
How Mobot tackles it: With only this prompt, Mobot inferred the right data source, identified the ‘service’ and ‘_loglevel’ fields, and constructed and ran the query. It quickly returned a ranked table with error counts, total requests, and error rate percentages across all services. It even surfaced problematic dependencies the engineer didn’t know to look at (like a background ‘cert-manager’ running at a 98% error rate).
The result: Mobot eliminates “dashboard blindness” and reduces reliance on tribal knowledge. Instead of needing to know exactly where to look, the engineer can surface hidden errors in services they might have otherwise ignored.
Example two: Root cause analysis
Context: Moving from “something is broken” to “here is why and where it started” is the hardest and most time-consuming part of any incident. Doing this manually requires knowing the system dependency graph in advance, manually correlating timestamps across multiple services, and building side-by-side time-series queries. Senior engineers with deep system knowledge might take a couple of hours to trace the source, while junior engineers might struggle to get there at all, frequently requiring a high-stress war room.
Starting prompt: “Show me upstream services that spiked in errors right before a downstream service degraded.”
How Mobot tackles it: Mobot automatically built a five-minute resolution error rate and latency timeline across the full dependency chain. It reconstructed the exact causal sequence: ‘currencyservice’ failing for six+ hours, ‘paymentservice’’ hitting a MySQL failure at 07:10, checkoutservice latency exploding within minutes, and ‘frontendservice’ degrading downstream.
The result: Mobot automates the work of a senior engineer and a two-hour war room, instantly producing a timestamped propagation chain. The kind you’d normally only get after writing a full incident post-mortem—from a single prompt.
Mobot for Cloud SIEM Insights
By enabling the SOC Analyst Agent (currently in Preview) within Cloud SIEM, you can also leverage Mobot to streamline investigative workflows. The SOC Analyst Agent autonomously investigates Insights, applies a severity verdict, and compiles supporting evidence so your analysts start with a preliminary investigation. When the human analyst determines an Insight needs a deeper investigation, they can seamlessly take the reins and run their own advanced analysis with Mobot.
Learn more about how the SOC Analyst Agent and Mobot work together.
Try it for yourself
Ready to see how Mobot can take the friction out of your log analysis? The new Mobot experience is currently in early preview with select customers and will be moving toward General Availability soon. Customers interested in joining the preview can reach out directly to their Sumo Logic account team to request access.
If you’re new to Sumo Logic and interested in seeing how Dojo AI and Mobot can transform your operations from the ground up, schedule a demo with our team.
