Skip to main content
Sumo Logic

Edit a LogReduce Signature

Editing a signature allows you to choose values that should be treated as wildcards. After you replace one or more values with a wildcard (*****) the LogReduce algorithm treats each value as the same, which expands the number of results.

For example, let's say that your search contains log messages with sessionID and eventTime values that you know will be different in each log message. In this situation, you don't want the LogReduce algorithm to be quite so specific, so edit the signatures highlighted below:

logreduce_example_step1_700x211.png

Figure 1

When you re-run this report, you'll get the following results:

logreduce_example_results_700x179.png

Figure 2

Note that the previous line 7 (from Figure 1, above) was combined with the line above it, where the sessionID value was already being treated as a wildcard. This means that the line has jumped up to number 5 (in Figure 2), and that there are more results. If more specific results are needed, you could split the signature to break them out once again.

Edit a signature

  1. Select text in the signature you'd like to edit. 
    summarize_edit.png
  2. The text is replaced with a wildcard. Click Apply to apply your changes. 
    summarize_edit_apply.png
  3. (Optional) If you're not happy with the results at any time, click Undo or Cancel.

Make multiple edits to a single signature

If there are two strings you'd like to replace with a wildcard, you can make the changes, then apply them at the same time. Click the Apply button to save the wildcards.

  1. Select some of the text you'd like to replace with a wildcard. When you release your selection, the text changes to a wildcard. 
    summarize_multiple1.png
  2. Then select the next portion of text you'd like to replace. Both text selections are now wildcards. 
    summarize_multiple2.png
  3. Click Apply.
    summarize_multiple3.png
  4. (Optional) If you're not happy with the results at any time, click Undo or Cancel.