Facet a query across dimensions (ranked top-N counts)
sumo_facetsDiscover the distribution of log field values by running concurrent count-by-dimension queries, returning ranked tables per dimension.
Instructions
The fastest way to see the SHAPE of matching logs before reading any messages: runs one small "count by " aggregate per dimension (concurrently; every job auto-deleted) and returns a compact ranked table per dimension. Dimensions starting with "_" are native Sumo fields (e.g. _sourcecategory, _sourcehost); anything else is parsed from the JSON payload as log. (e.g. levelname, status, path). One failing dimension yields an error line, never a total failure. Time range: exactly ONE of last (relative, e.g. "15m", "2h"; units s/m/h/d) OR both from and to (ISO-8601 like 2026-07-02T18:28:00, or epoch milliseconds).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: ISO-8601 or epoch ms. Requires `from`. | |
| from | No | Start time: ISO-8601 or epoch ms. Requires `to`. | |
| last | No | Relative window ending now, e.g. "15m", "2h", "1d". Mutually exclusive with from/to. | |
| limit | No | Top-N values per dimension (default 15, max 100). | |
| query | Yes | Sumo Logic scope query (keywords + metadata filters). Scope only — no | operators; each dimension appends its own "| count by". | |
| timeZone | No | IANA timezone for query-time parsing (default UTC). | |
| dimensions | No | Dimensions to facet on (default ["_sourcecategory","_sourcehost","levelname","status","path"]). One concurrent search job each. | |
| byReceiptTime | No | Search by receipt time; recommended true for very recent windows (ingestion lag). |