Searching Data Tiers
This page has information about how to search different Data Tiers, and when you should use _dataTier, a search modifier that restricts your search to a single tier.
About the _dataTier search modifier
In Sumo Logic, a search modifier is a tag that gives the Sumo Logic backend information about how to process a query. The _dataTier modifier tells Sumo Logic which Data Tier a query should run against: Continuous, Frequent, or Infrequent.
When you include the _dataTier modifier in a query, the query will run against only the tier you specify. If you do not specify one or more partitions in the query, using _index, the query will run against all partitions in the tier you specified with _dataTier.
You don’t have to specify a Data Tier when you run a query. If you don’t include _dataTier, how we run the search depends on whether or not you specify one or more partitions using _index.
- If you don’t specify a partition using
_index(you only specify keywords and metadata) the search runs against the Continuous tier. - If you specify multiple partitions, Sumo Logic infers the Data Tier for each partition from the partition names.
Examples
| Example query | How query is processed |
|---|---|
_dataTier=Infrequent error |
Searches all the partitions in the Infrequent tier for messages that contain the string “error”. |
_index=<InfreqPart> error(Where InfreqPart is a partition in the Infrequent tier.) |
Searches the partition named “InfreqPart” in the Infrequent tier for messages that contain the string “error”. |
_index=<InfreqPart1> or _index=<InfreqPart2> error(Where InfreqPart1 and InfreqPart2 are partitions in the Infrequent tier.) |
Searches the partitions named “InfreqPart1” and “InfreqPart2” in the Infrequent tier for messages that contain the string “error”. |
_index=<InfreqPart1> or _index=<FreqPart2> error(Where InfreqPart1 and FreqPart2 are partitions in the Infrequent and Frequent tiers respectively.) |
Search gives you an error, since the two partitions are from different data tiers |
_sourceCategory=apache error |
Searches the Continuous tier for messages that contain the string “error”. |
_dataTier limitations
The _dataTier search modifier is not supported in:
- Live mode dashboards
- Role search filters
- Real time alerts
- Partition routing expressions
- Logs-to-Metrics rules
In addition, because _dataTier is a reserved name in Sumo Logic, you can’t assign it to a Field or in a parse expression for a Field Extraction Rule.
_dataTier and scheduled views and audit indexes
When you query scheduled views, the Sumo Logic Audit Index, or the Sumo Logic Audit Event Index, it isn’t necessary to specify a tier with _dataTier. Search these indexes using _index. By default, Sumo will run such queries against the Continuous tier.
If you use _dataTier to specify a tier other than Continuous in a query of scheduled views or either of the audit indexes, Sumo Logic presents an error message.