Facet a query across dimensions (ranked top-N counts)
sumo_facetsRun concurrent count-by-dimension aggregates to see the distribution of log fields, returning compact ranked tables per dimension for quick insight into matching logs.
Instructions
The fastest way to see the SHAPE of matching logs before reading any messages: runs one small "count by " aggregate per dimension (concurrently; every job auto-deleted) and returns a compact ranked table per dimension. Dimensions starting with "_" are native Sumo fields (e.g. _sourcecategory, _sourcehost); anything else is an ABSOLUTE JSON path from the _raw root (e.g. stream, log.levelname, log.status — dots allowed). A dimension that is 100% (none) probably does not exist at that path — run sumo_describe_schema to learn the scope's real fields. Numeric keys match numerically when filtering (num(x) = 404) — some producers emit float-strings like "404.0" (displayed coerced). One failing dimension yields an error line, never a total failure. Time range: exactly ONE of last (relative, e.g. "15m", "2h"; units s/m/h/d) OR both from and to (ISO-8601 like 2026-07-02T18:28:00, or epoch milliseconds).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: ISO-8601 or epoch ms. Requires `from`. | |
| from | No | Start time: ISO-8601 or epoch ms. Requires `to`. | |
| last | No | Relative window ending now, e.g. "15m", "2h", "1d". Mutually exclusive with from/to. | |
| limit | No | Top-N values per dimension (default 15, max 100). | |
| query | Yes | Sumo Logic scope query (keywords + metadata filters). Scope only — no | operators; each dimension appends its own "| count by". | |
| timeZone | No | IANA timezone for query-time parsing (default UTC). | |
| dimensions | No | Dimensions to facet on (default ["_sourcecategory","_sourcehost"]). One concurrent search job each. | |
| byReceiptTime | No | Search by receipt time; recommended true for very recent windows (ingestion lag). |