- In Sumo Logic, go to Manage > Data Configuration > Scheduled Views (Manage > Scheduled Views in the classic UI).
- Click Add.
- In the Create a View dialog box, enter the following:
- View Name. Type a name that you'll use to search the data in a query. It's important to use a name that's descriptive and easy to remember. Names can contain alphanumeric characters; underscores( _ ) are the only special characters allowed.
- Query. Type the full query that encompasses the data you'd liked indexed in the view. Parse operators and most search operators are supported in views.
- Start Time. Click the date and time that you'd like to use as the start time of the index. All data from that point forward will be indexed in the scheduled view. The oldest selectable date represents the end of the retention period of your Sumo Logic account.
- Retention Period. Enter the number of days to retain this view, or check the Apply the retention period of the General Index box.
- Click Create.
The view begins to index data as soon as you create it. Allow a few hours for the indexing to complete. If you've chosen to index a large amount of data and/or have chosen a long date range for the view, it could take a bit longer.
Once created, scheduled views are executed once per minute.