Skip to main content
Sumo Logic

Lab 1 - Search Basics: Metadata and Keywords

You will learn the use of metadata and keywords to narrow your search scope and improve performance.
In this lab, you will learn the use of metadata and keywords to narrow your search scope and improve performance.

 

  1. Search for all messages for the last 6 hours with  _sourceCategory=Labs/AWS/CloudTrail that contain the word "root".

_sourceCategory=Labs/AWS/CloudTrail and root

  1. Search for messages across all your AWS data that contain the word "root".

_sourceCategory=Labs/AWS/* and root

  1. Run a Live Tail session for the same query as #1.

 

QUIZ: True or False

  1. Keywords are case-sensitive  

  2. AND is implicit and OR is explicit

  3. Keywords and metadata can use wildcards

  4. Live Tail must contain at least one metadata tag