Searching Data Tiers
This page has information about how to search different Data Tiers, and when you should use _dataTier, a search modifier that restricts your search to a single tier.
About the _dataTier search modifier
In Sumo Logic, a search modifier is a tag that gives the Sumo Logic backend information about how to process a query. The _dataTier modifier tells Sumo Logic which Data Tier a query should run against: Continuous, Frequent, or Infrequent.
When you include the _dataTier modifier in a query, the query will run against only the tier you specify. If you do not specify one or more partitions in the query, using _index, the query will run against all partitions in the tier you specified with _dataTier.
You don’t have to specify a Data Tier when you run a query. If you don’t include _dataTier, how we run the search depends on whether or not you specify one or more partitions using _index.
- If you don’t specify a partition using
_index(you only specify keywords and metadata) the search runs against the Continuous tier. - If you specify multiple partitions, Sumo Logic infers the Data Tier for each partition from the partition names. If the specified partitions are in different Data Tiers, Sumo Logic presents an error message. Sumo Logic does not currently support querying data across multiple tiers within the same search query.
Examples
| Example query | How query is processed |
|---|---|
_dataTier=Infrequent error |
Searches all the partitions in the Infrequent tier for messages that contain the string “error”. |
_index=<InfreqPart> error(Where InfreqPart is a partition in the Infrequent tier.) |
Searches the partition named “InfreqPart” in the Infrequent tier for messages that contain the string “error”. |
_index=<InfreqPart1> or _index=<InfreqPart2> error(Where InfreqPart1 and InfreqPart2 are partitions in the Infrequent tier.) |
Searches the partitions named “InfreqPart1” and “InfreqPart2” in the Infrequent tier for messages that contain the string “error”. |
_index=<InfreqPart1> or _index=<FreqPart2> error(Where InfreqPart1 and FreqPart2 are partitions in the Infrequent and Frequent tiers respectively.) |
Search gives you an error, since the two partitions are from different data tiers |
_sourceCategory=apache error |
Searches the Continuous tier for messages that contain the string “error”. |
_dataTier limitations
The _dataTier search modifier is not supported in:
- Live mode dashboards
- Role search filters
- Real time alerts
- Partition routing expressions
- Logs-to-Metrics rules
In addition, because _dataTier is a reserved name in Sumo Logic, so you can’t assign it to a Field or in a parse expression for a Field Extraction Rule.
_dataTier and scheduled views and audit indexes
When you query scheduled views, the Sumo Logic Audit Index, or the Sumo Logic Audit Event Index, it isn’t necessary to specify a tier with _dataTier. Search these indexes using _index. By default, Sumo will run such queries against the Continuous tier.
If you use _dataTier to specify a tier other than Continuous in a query of scheduled views or either of the audit indexes, Sumo Logic presents an error message.