Index Aliasing for Search Queries

We're excited to introduce the ability to reference Sumo Logic system indexes with an alias. With this update, you can now use an alias to point to one or more system indexes in the source expression of your search queries.

How it works

With index aliasing, you can use an alias to point to one or more system indexes, such as sumologic_default in the source expression of your query. Both the operator part and results of your query will consist of actual index names.

In addition to sumologic_default, we have several other Sumo Logic-defined system indexes. As a shortcut, rather than prefacing sumologic_ when referencing system indexes in a search, you can alias these indexes by typing an underscore at the beginning. For example, sumologic_default and _default will return the same results. 

Learn more here.

NOTE: This feature is currently live in all deployments except us2 and prod. It will be rolled out to those deployments by April 2.