Meet the new Glossary
This glossary defines Sumo Logic terms you're likely to encounter in our documentation. It does not cover general industry terms unless they're also Sumo Logic features.
For usage and style guidance, see the Word List.
For general DevOps and security industry terms, see our DevOps and Security Glossary.
A
Absolute expression. Used in time range expressions, when setting a specific time range of a search. For example, 04/01/2026 20:32:00 to 04/01/2026 20:35:00 will run the search from April 1, 2026 at 8:32 PM until April 1, 2026 at 8:35 PM.
Access key. A key, generated by Sumo Logic, that you use to securely register new collectors and to access Sumo Logic APIs.
Admin mode. If your Sumo Logic role grants you the Manage Content capability, you can switch to Admin mode so that you can move content from one folder to another for anyone in your org, and mark content “Admin Recommended”.
Admin recommended. An area at the top of the Sumo Logic Library in the Left-Nav that lists highlighted content. A Sumo Logic user with the Manage Content capability can add content to the admin recommended list.
Aggregate. A group of data returned by a search, displayed in a simple table in the Aggregates tab of the Search page.
Alert. A notification triggered when a monitoring condition is met. In monitors, an alert is created when critical, warning, or missing data trigger conditions are satisfied. It includes contextual information to help investigate the issue. In scheduled searches, alert types include Email, Script Action, ServiceNow Connection, Webhook, and Save to Index.
Allowlist. A list of IP addresses or CIDR ranges that are explicitly granted access to logins, APIs, and dashboards. Configured on the Service Allowlist Settings tab in Account Security Settings.
Amazon S3 Audit source. The Amazon S3 Audit source, also called Server Access Logging, tracks and collects your Amazon S3 bucket's activity logs.
Analyst. A Sumo Logic user role for non-administrators who primarily search logs, build dashboards, investigate data, and monitor their environment. Analyst capabilities are determined by the roles and permissions assigned to them.
App. Sumo Logic apps (short for applications) deliver out-of-the-box dashboards, reports, saved searches, and field extraction for popular data sources, such as AWS, Windows, Apache, and many more. When a customer installs an app in Sumo Logic, preconfigured searches and dashboards are customized with the customer's source configurations and populated in a folder. Customers then can monitor their system's behavior visually using the dashboards.
Audit Index. A Sumo Logic index that stores event logs about internal account activities such as account management, throttling, and scheduled searches. Administrators must enable the Audit Index before it can be queried using _index=sumologic_audit.
Automation Bridge. A component of the Automation Service that you install in your on-premises environment to run custom actions and integrations outside the Sumo Logic cloud.
Automation Service. In Cloud SIEM, a service that automatically runs tasks such as sending notifications or adding data to records when security incidents occur.
B
Burst limit. The point at which Sumo Logic slows metric data ingestion to keep it within your allowable contracted limits. Metric data volume is measured in Data Points per Minute (DPM). Sumo Logic allows for spikes in metrics ingestion until it reaches a calculated burst limit, then starts throttling your data sources.
C
Capability. In Sumo Logic role-based access control (RBAC), you grant the users with a role the right to perform a particular function by assigning the corresponding capability to the role. For example, the “Manage Collectors” capability allows a user to install and manage installed and hosted collectors and sources.
Carbon 2.0. A plaintext metric format in which metrics are identified by key-value pairs. In Carbon 2.0, the actual thing being measured is identified by intrinsic tags; additional metadata is provided in meta tags. Sumo Logic’s HTTP source and Streaming Metric Source support Carbon 2.0 metrics.
Cardinality. Refers to the uniqueness of values in a database column or metric dimension. High cardinality metrics are metrics with dimensions that have many different values, which can result in a high volume of unique time series. In Sumo Logic, you can use a transformation rule to aggregate high cardinality data from ephemeral sources into higher-level metrics that you want to analyze over time.
Clobber. During the installation process, use the clobber flag in situations where you're creating a new collector that will use a name that is already in use by another collector. Clobber deletes (clobbers) the existing collector with the same name.
Cloud SIEM. A cloud-native security information and event management solution that automatically normalizes, correlates, and analyzes your security data. Cloud SIEM surfaces insights that help security analysts detect and investigate threats faster.
Cloud SOAR. A security orchestration, automation, and response platform that helps security teams streamline incident response. Cloud SOAR automates repetitive tasks, orchestrates workflows across security tools, and tracks the full incident lifecycle.
Cloud-to-Cloud Integration Framework. A fully-managed collection system that collects logs and events directly from SaaS and cloud platforms such as Salesforce, Microsoft 365, and Okta. The framework handles authentication, scheduling, and state tracking automatically. Also referred to as C2C.
Collector. Sumo Logic collectors are lightweight applications that allow you to connect your environment to Sumo Logic in order to collect message data. There are two types of collectors. Installed collectors are configured on machines in your deployment for sources such as Local File, Remote File, Syslog, Local Windows Event Logs, Remote Windows Event Logs, and Script. Hosted collectors require no installation, and are used to collect data from various services like Amazon S3 or over HTTP and Syslog.
Content administrator. In the Sumo Logic Library, you can choose View as Content Administrator to enter Admin mode, so you can manage content for your org. In Admin mode you can migrate content from one location to another, and highlight important content in the Admin Recommended folder.
Content sharing. A Sumo Logic feature that allows you to share searches, dashboards, and folders with a user, a role, or combinations of the two.
Credit. A unit of measure that tracks account usage, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose.
D
Dashboard. Dashboards contain a collection of real time panels that provide a graphical representation of your org's data. Panels are created by running search queries. From the resulting data in the Search page's Aggregates tab, you can display that data using different types of charts. Once panels are created, they are saved to a dashboard.
Data access level. The data access level for a dashboard determines what data a user with whom the dashboard is shared can view in the dashboard.
Data Forwarding. When enabled, the Data Forwarding feature allows Sumo Logic to upload data to an Amazon S3 bucket that belongs to your org. Log messages are saved as CSV files in compressed gzip files. They are accumulated and returned right after being ingested by Sumo Logic.
Data Tiers. A Sumo Logic feature that lets you allocate log data to one of three storage tiers (Continuous, Frequent, or Infrequent) based on how often you need to access it. All data defaults to the Continuous tier; only data stored in partitions can be assigned to the Frequent or Infrequent tier.
Data type. A data type is a specific type of log used with a Sumo Logic source or app, such as Apache, MySQL, or Windows IIS. You can also use a custom data type for a custom application.
Data volume index. The data volume index automatically provides data that allows you to understand your account’s data ingest volume in bytes and number of log messages processed overall. The data volume index gives you better visibility into how much data you are sending to Sumo Logic, allowing you to proactively manage your systems’ behavior and to fine tune your data ingest with respect to the data plan for your Sumo Logic subscription.
Deployment. Sumo Logic has several deployments that are assigned depending on the geographic location and the date an account is created.
Detected relationship. In Cloud SIEM, a relationship detected between entities that appear together in a record, such as an IP address and hostname in the same log message, even if they are not part of the insight currently being viewed. Displayed as solid lines in the entity graph.
Dimension. In Carbon 2.0 and Prometheus metrics, dimensions are the one or more space-separated key-value pairs that uniquely identify what is being measured. Dimensions are also referred to as intrinsic tags and labels.
Disabled metric source. A metric source that Sumo Logic has disabled because it has received too many unique time series. A disabled metric source will stop receiving data, and that data cannot be recovered.
DPM. Stands for data points per minute. Metric data volume is measured in DPM. For example, a CPU metric reported on a single host every 15 seconds produces 4 DPM.
Dynamic Parsing. A Sumo Logic feature that automatically extracts fields from JSON log messages at search time, without requiring manual parse rules. Also called Auto Parse. "Dynamic Parsing" is used in documentation and the API, while "Auto Parse" appears in the UI.
E
Endpoint. Sumo Logic has several pods that are assigned depending on the geographic location and the date an account is created. Sumo Logic redirects your browser to the correct login URL and also redirects collectors to the correct endpoint. However, if you're using an API you'll need to manually direct requests to the correct API endpoint; API calls are not redirected to another endpoint.
Enrichment. In Cloud SIEM, addition of data to records that provides more information for analysis of security incidents.
Entity. In Cloud SIEM, a unique actor encountered in incoming messages, such as a user, IP address, or host.
Ephemeral. Refers to data sources, such as containers, that are created and destroyed as appropriate, resulting in a high volume log data or metrics. In Sumo Logic, you can set a collector to be ephemeral. Sumo Logic deletes an ephemeral collector automatically after it has been offline for 12 hours.
Exclude rule. Exclude rules are a type of processing rule that specifies log messages that you do not want to send to Sumo Logic, think of it as an "allowlist" filter.
F
Favorite. The Favorites tab displays searches and dashboards that you refer to frequently, or content that you want to keep handy. In the Library, on the Personal and Org tabs, you can "favorite" content to make it appear on the Favorites tab. Just click the star icon for your saved search, dashboard, installed app, or folder, and it will be saved to the Favorites tab for easy access. You can also favorite saved searches from the Search page, and favorite from the Dashboards page.
Field. Fields allow you to reference log data based on meaningful associations. They act as metadata tags that are assigned to your logs so you can search with them. Each field contains a key-value pair, where the field name is the key. Fields may be referred to as log metadata fields.
Field extraction rule. Field extraction can be set up as rules that parse out fields as log messages are ingested. This means that instead of running a query to parse out fields, that work is done automatically so when it's time to run a search the fields are already available in results.
fields operator. A search operator that selects which fields to include or exclude from query results. Use allowlist mode to keep only specified fields, or denylist mode to drop specified fields and return the rest.
Fingerprint. A fingerprint consists of the first 2048 bytes of a file and is used by installed collectors to track what data has been collected.
Flex Account. Sumo Logic's credit-based account packaging, available as Free, Trial, Essentials, or Enterprise Suite Flex. All Flex account types use credits as the unit of measure for data ingested, stored, and scanned.
Flow graph. A graph or map that dynamically displays a directional flow from a source to a target. Such as the flow of cyber threats from the geographic locations of sources to their targets, dynamically illustrated in the Threat Sources and Targets by Geography panel of the Amazon GuardDuty Global Baseline dashboard.
formatDate operator. A search operator that converts a timestamp in milliseconds to a human-readable date string in the format you specify, such as yyyy-MM-dd or MM/dd/yyyy HH:mm:ss.
G
Geo lookup. Using the lookup search operator with a geo:// table to match a parsed IPv4 or IPv6 address to a physical location for mapping. Written as two words; there is no separate geolookup keyword.
Graphite. A plaintext metric format where the thing you’re measuring is identified by a dot-separated string, referred to as a metric path. Sumo Logic’s HTTP source and Streaming Metric Source support Graphite metrics.
Group. A search operator keyword that groups aggregation results by one or more fields. group, by, and group by are interchangeable, so count by user and count group by user are the same. Each aggregation function returns a field prefixed with an underscore, such as _count.
H
Hash rule. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden.
Health Event. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings.
Host Metrics. The Sumo Logic app for Host Metrics allows you to collect local host metrics and display them using predefined search queries and dashboards. The app provides dashboards to display analysis of local host metrics for the CPU, disk, memory, network, and TCP.
Hosted collector. Hosted collectors do not require installation or registration, nor do hosted collectors have physical requirements, since they're hosted by Sumo Logic in AWS.
I
Include rule. Include rules are a type of processing rule that is used to send only the data you'd like in your Sumo Logic account (an "allowlist" filter). This type of filter can be very useful when the list of log data you want to send to Sumo Logic is easier to filter than setting up exclude filters for all of the types of messages you'd like to exclude.
Ingest budget. Ingest budgets control the capacity of daily log ingestion volume sent to Sumo Logic from collectors.
Insight. In Cloud SIEM, a group of signals clustered around a single entity that are generated when an entity’s Activity Score exceeds a threshold.
Installation token. Installation tokens are assigned to your org and are used to register installed collectors to your Sumo Logic account. They do not expire and can only be used to register installed collectors. You can deactivate, reactivate, or delete tokens at any time.
Installed collector. Installed collectors are deployed in your environment, either on a local machine, a machine in your org, or even an Amazon Machine Image (AMI). Installed collectors require a software download and installation. Upgrades to collector software are released regularly by Sumo Logic.
Intrinsic tag. In Carbon 2.0-formatted metrics, intrinsic tags are the one or more space-separated key-value pairs that uniquely identify what is being measured. Intrinsic tags are also referred to as dimensions.
K
Keyword Search Expression. The portion of a log search query that precedes the first pipe symbol. Defines the scope of data for the query using Boolean logic, wildcards, and metadata fields such as _sourceCategory and _collector.
Kubernetes view. Allows you to intuitively filter on four hierarchical components of your Kubernetes system to focus your search on nodes, deployments, services, or namespaces. Kubernetes Views make it easier to traverse your Kubernetes hierarchy to monitor specific components, identify problems, discover root problems, and take progressive action.
L
Library. The Library provides a central location for shared and saved content in your Sumo Logic account, as well as content shared by others in your org. In addition to shared and saved searches, dashboards can be saved and shared in the Library.
Live Tail. Sumo Logic Live Tail allows you to see a real-time live feed of log events associated with a source or collector. The live feeds can help you with development and troubleshooting. You can see all log messages as they come in, but they are not sorted as they are with search.
Local configuration file management. Local configuration file management allows you to set up and manage sources on an installed collector using one or more JSON files.
Log Analysis Agent. One of the specialized agents that powers Mobot. The Log Analysis Agent interprets intent, guides investigations, and surfaces relevant data from your logs through natural language. Formerly called the Query Agent.
LogCompare. LogCompare allows you to compare a section of your log messages from one point in time with the same section at another point in time, and display the changes in patterns.
LogReduce®. The LogReduce operator uses fuzzy logic to cluster messages together based on string and pattern similarity. Use the LogReduce button and operator to quickly assess activity patterns for things like a range of devices or traffic on a website. See also: Operators.
Logs for Security. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data.
Logs-to-Metrics. A Sumo Logic feature you can use to extract or create metrics from log data. You can extract metrics that are embedded in logs, or count logs as a metric.
Lookup Table. A table of reference data hosted in Sumo Logic that you can join to log search results to enrich them with additional context. For example, you can map a user ID in a log to an email address, department, or other attribute stored in the table.
M
Mapper. In Cloud SIEM, a script that maps message fields to record attributes.
Markdown. Used in dashboards, you can add text panels to include titles or text descriptions. Use Markdown syntax to add bold or italic formatting, bullet lists, code font, and other formatting.
Mask rule. Mask rules are a type of processing rule that replaces an expression with a mask string that you can customize. This is another option to protect data, such as passwords, that you would not normally track.
MCP Server, Sumo Logic. A Sumo Logic service that lets AI clients compatible with the Model Context Protocol (MCP), such as Claude Code, developer IDEs, and enterprise AI platforms, connect to Sumo Logic using natural language to query logs, investigate Cloud SIEM insights, manage alerts, and more.
Messages tab. When you run a search query, messages display in the Messages tab in the lower half of the browser window of the Search page.
Meta tags. In Carbon 2.0-formatted metrics, meta tags are the key-value pairs for a metric that provide additional, but not identifying information about the thing being measured. A meta tag is a piece of metadata that might be useful in querying your metrics.
Metadata. Data about other data. If the logs and metrics you ingest have associated metadata, you can leverage it for more targeted log searches and metric queries. Metadata for metrics includes both intrinsic tags and meta tags.
Metric rule. A Sumo Logic feature that allows you to tag metrics with data derived from the metric identifier. Then, you can use those tags in metric queries.
Metric rules editor. A page in the Sumo Logic web app for creating metric rules.
Metric throttling. A Sumo Logic feature that throttles your metric sources when you exceed your DPM burst limit. Your ingestion is slowed down until the rate of ingestion is within the allowable contracted limits.
Metric volume index. A Sumo Logic index to which Sumo Logic writes messages with information about the volume of metrics you are ingesting.
Metrics transformation rule. Metrics transformation rules allow you control how long raw metrics are retained. You can also aggregate metrics at collection time and specify a separate retention period for the aggregated metrics.
Mobot. Sumo Logic's AI assistant. Ask questions in natural language to search logs, investigate security insights, get platform guidance, and more. Mobot automatically routes questions to specialized agents based on your intent.
Monitor. An object you configure in Sumo Logic that tracks your metrics and logs data in real time and sends notifications when noteworthy changes happen in your production applications. A monitor checks for specific events of interest against a data source based on your conditions, then notifies you according to your preferences.
Multiline. Log messages that span multiple lines are called multiline messages.
N
Node. In Automation Service playbooks, a step that performs a specific action within a playbook. Nodes run in the order they are placed; when all nodes complete without error, the playbook is considered to have executed successfully.
O
OpenTelemetry Collector, Sumo Logic. An open-source, vendor-agnostic agent for collecting, processing, and exporting telemetry data such as logs, metrics, and traces. Sumo Logic supports the OpenTelemetry Collector as a unified alternative to installed collectors for sending observability data to Sumo Logic.
Organization. In Sumo Logic, org, or organization, refers to your company’s Sumo Logic account (not an individual user’s account).
Outlier. A value in a sequence that deviates from the expected range and may signal an operational or performance issue. Identify outliers in logs with the outlier search operator, and in metrics with the outlier metrics operator.
P
Panel. A component of a dashboard. Every panel is either a data panel, driven by a search query and rendered as one of several chart types, or a text panel, containing static Markdown. Data panels are built from the Search page's Aggregates tab and saved to a dashboard.
parse operator. A search operator that extracts fields from strings. parse (also called parse anchor) uses literal start and stop anchors; parse regex (also called extract) uses a regular expression.
parse json operator. A search operator that extracts values from JSON-formatted log messages using JSONPath expressions. Supports single fields, multiple fields, nested keys, and array elements.
parse keyvalue operator. A search operator that extracts values from key-value pair formatted log messages by specifying the key you want to retrieve. Also written as keyvalue.
parse nodrop option. A parse option that forces results to include messages that do not match the parse expression. Without nodrop, non-matching messages are dropped from results.
parse regex operator. A search operator that uses regular expressions with named capturing groups to extract complex or nested fields from log messages. Also written as extract.
Parser. In Cloud SIEM, a script that parses logs and normalizes them into structured records.
Partition. Sumo Logic allows you to filter a subset of the messages in an index into a partition. Partitioning messages in an index improves search query performance, as the total number of messages that need to be searched is reduced. Once messages are routed to a partition, you can limit your search to those messages using the partition name in a search query.
Pinned search. The pinned search feature allows you to start a search, then “pin” it, so it will continue running in the background independent of the browser session. Then, you can close the Search tab or log out and find your results later in the Library on the Recent tab in a folder named Pinned Searches.
Platform Optimization Agent. One of the specialized agents that powers Mobot. The Platform Optimization Agent answers how-to questions about Sumo Logic, helps troubleshoot issues, and helps users get more from the platform, drawing on official Sumo Logic documentation. Formerly called the Knowledge Agent.
Playbook. In the Automation Service, a predefined set of actions and conditional statements that run as an automated workflow in response to a security event or incident. Playbooks can run automatically without user intervention or in interactive mode, where a user must authorize specific actions.
Processing rule. A Sumo Logic feature you can use to filter or forward log data ingested by Sumo Logic from a Sumo Logic source. You can use processing rules to include or exclude messages, and to mask or hash sensitive information in logs. You can also forward matching messages to external destinations, including AWS S3.
Prometheus. A metric format in which a time series is uniquely identified by its metric name and a set of labels in key-value pairs format. Sumo Logic’s HTTP source and Streaming Metric source support Prometheus metrics. Sumo Logic’s Kubernetes solution also collects Prometheus metrics.
Q
Quantization. The process by which Sumo Logic aggregates raw metric data points over a particular time bucket. Similar to “timeslice” in logs, Sumo Logic will automatically bucket your datapoints into quantization intervals based on the time range of your search. For example, 5 second quantization intervals for a 15-minute search and 15 seconds for a 60-minute search.
quantize operator. A metrics operator that sets the size of the time buckets Sumo Logic aggregates metrics into, and the aggregation method for each bucket. It is the metrics-query counterpart of the timeslice search operator.
R
RBAC. Sumo Logic supports Role-Based Access Control (RBAC) to allow administrators to customize system access. With RBAC, administrators create roles for groups of users who perform various job functions. Users are not assigned permissions directly, but inherit permissions through roles (or even through a single role). Role assignments can grant users permissions to access some data sets, or can restrict users from accessing types of data.
Real User Monitoring (RUM). A Sumo Logic APM capability that captures end-to-end user transactions directly in the browser using OpenTelemetry instrumentation. RUM records performance timings, rendering events, errors, and user cohort data so you can understand the quality of your web application experience.
Receipt time. You can display search results in the order that the collector received the messages in milliseconds.
Record. In Cloud SIEM, a collection of normalized data created from a message.
Related insight. In Cloud SIEM, an insight that a related signal is attached to.
Related signal. In Cloud SIEM, a signal that is not part of the current insight (not attached), but fired on the same entity as the current insight's attached signals within 7 days of those signals.
Relative expression. Used in time range expressions, when setting the non-absolute time limits of a search. For example, -1d, -1d -12h, -12h -60m.
Role. In Sumo Logic role-based access control (RBAC), you grant users access to data and to Sumo Logic functions using roles. You assign role capabilities and a role search filter to a role, and assign one or more roles to a user.
Role search filter. A search filter for a role defines what log data a user with that role can access. You can define a search filter using keywords, wildcards, and selected Sumo Logic metadata fields and logical operators.
Rollup table. Metric data are stored in Sumo Logic as raw data points, and aggregated over one minute and one hour resolutions. The one minute and one hour aggregated metrics are referred to as rollup tables. Raw data are retained for 7 days, one-minute rollups for 30 days and one-hour rollups for 13 months.
Rule. In Cloud SIEM, a set of logic that fires on incoming records and creates signals when its conditions are met. Cloud SIEM includes six rule types: Match (fires on a single record match), Threshold (fires when a record matches a minimum number of times in a time window), Chain (fires on combinations of event types over a time window), Aggregation (fires when aggregation conditions are met), First Seen (fires when an entity exhibits a behavior for the first time), and Outlier (fires when entity behavior deviates from its established baseline).
S
SAML. Sumo Logic supports self-provisioning of Security Assertion Markup Language (SAML) to enable Single Sign-On (SSO). In addition to basic SAML configuration, you can choose optional on-demand user creation (via SAML 2.0 assertions), and designate custom log in and/or log out portals.
Scheduled action. In the Automation Service integration framework, an action type whose execution repeats until a specific exit condition is met, enabling loops within a playbook.
Scheduled search. When you save a log search, you can schedule it to run it on a periodic basis, and configure an alert that will issue a notification every time the search runs, or when a condition you specify is met.
Scheduled view. A scheduled view is a pre-aggregated index of a subset of data. After building a scheduled view, you'll be able to run queries against that data set. Because the data are pre-aggregated, meaning that query you'll use to create a scheduled view contains an aggregate function, search results return much quicker. Additionally, queries run against a scheduled view cannot time out. Queries that run against views can be used in scheduled searches, dashboards, and in ad hoc searches.
Search autocomplete. On the Search page of the Sumo Logic user interface, the search autocomplete dropdown dialog offers suggestions to make query writing easier. Suggestions include simple logic that offers common default queries, keywords, metadata terms, and search operators. The autocomplete dialog also includes links to Help topics for more information.
Search template. Search templates simplify searches for users by providing easy to select input choices. You can have search templates replace any text in a query, including fields, keywords, and arguments to operators.
Searchable time. You can display search results in the order in which logs become available for search after being received by the Sumo Logic system.
Signal. In Cloud SIEM, an indicator of an event of interest that fires when rule conditions are met.
SOC Analyst Agent. An AI-powered Cloud SIEM feature that automatically investigates security insights, delivers evidence-backed verdicts (malicious, suspicious, or benign), and surfaces key findings from triggered signals to help security analysts triage faster and reduce false-positive noise.
Source. Sources are configured on Sumo Logic collectors and collect customer data.
Subquery. Subqueries allow you to filter and evaluate conditions for a log query when you may not be sure of the exact filter or condition criteria but you can write a short query to set them for you. Subqueries use one query to pass results back to another query to narrow down or evaluate the set of messages that are searched in that query.
Support account. A support account is a special Sumo Logic user account that you can enable so that Sumo Logic support personnel can access your Sumo Logic org. Typically, you enable your support account for a limited period of time, just long enough to allow Sumo Logic support to diagnose a problem or answer a question.
Suppressed signal. In Cloud SIEM, a signal that the insight algorithm excludes from the insight generation process. A suppressed signal does not contribute to or become part of an insight. By default, signals are automatically suppressed for 72 hours.
T
Threat Intelligence. A Sumo Logic feature that lets you ingest and query threat indicators to enrich log searches and Cloud SIEM detections. Threat indicators are data points about known threats, such as malicious IP addresses, file hashes, and hostnames. Indicators come from Sumo Logic-managed sources or custom sources you configure.
Throttling. Slows the rate of ingestion across all collectors in an account to not exceed the allowable rate.
Time Compare. Time Compare uses the compare operator to compare current aggregated search results with aggregated data from a past time period.
Time series. A set of timestamped values of a specific measurement.
timeslice operator. A search operator that groups log results into fixed time buckets, either by duration or by a bucket count. It is the log-search counterpart of the quantize metrics operator.
transaction operator. A search operator that groups logs into sequences keyed by a shared identifier and tracks each sequence's states. Not to be confused with transactionize, which groups on any matching field and does not model ordered states.
transactionize operator. A search operator that groups logs sharing any one of the fields you specify, where other group-by operators require all fields to match. Unlike transaction, it does not model ordered states.
U
user.properties. The user.properties file is used to pass collector parameters for some installation methods.