Add sumologic source #1078
Add sumologic source #1078
Conversation
| { | ||
| "statements": [ | ||
| { | ||
| "query": "WITH datetime()-duration('P7D') AS threshold MATCH (h:SumologicHost) WHERE h.lastupdated < threshold WITH h LIMIT $LIMIT_SIZE DETACH DELETE (h)", |
There was a problem hiding this comment.
Can you tell us how this works?
There was a problem hiding this comment.
This is the same thing as before but cleaning only entries lastupdated older than 7 days as per #1015
|
|
||
| | Field | Description | | ||
| |-------|-------------| | ||
| |tool_first_seen| Timestamp of when first available logs for host is available since first sync| |
There was a problem hiding this comment.
I think you meant to add the schema for the hosts?
There was a problem hiding this comment.
I don't understand the comment.
On tool_first_seen, this is limited by the duration given to sumologic query. if query only last 7d log, the earliest first seen is only 7d old, even if logging platform can have more.
But querying on long time period is expensive. And if the platform aka cartography server lives long enough, it will get there.
|
is there something that I can help to move this forward? |
Sumologic log platform
https://www.sumologic.com/
Reviewed with pylint and black