What arrived since the last poll (stateless cursor monitor)
sumo_new_sincePoll Sumo Logic for log messages that arrived since the previous call, returning a cursor for the next request. Provides gap-free, duplicate-free results using receipt-time windows.
Instructions
Stateless receipt-time monitor for polling loops: returns messages that ARRIVED since your last call plus a new cursor. First call: omit since to get a baseline over lookback (default "15m"). Every response contains a cursor=<epoch ms> line — pass that value as since on the next call and the half-open windows [since, now−settleMargin) tile contiguously with no gaps or duplicates. byReceiptTime is FORCED true and the window ends 180s in the past (settle margin) so late-arriving logs are not skipped — results are complete but ~180s stale. Aggregate queries (| count …) are rejected — use sumo_run_search for those. Token levers: detail=summary (whole-job counts by the AUTO-DETECTED severity field — exact via a side-aggregate with disclosed provenance, or a loud SAMPLE label if that fails — plus a compact histogram and top message signatures; cheapest) | compact (timestamp, level, request_id, _sourcecategory, FULL message, plus method/path/status when present) | full (compact + duration_s/logger/client_ip) | raw (verbatim _raw — logs exactly as the app emitted them, including anything sensitive it logged). See the fields/dedupe/maxMessageChars params for projection, grouping, and the message-length cap.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Order of returned messages by _messagetime (default "asc" = oldest→newest, best for tracing). Client-side: orders only the RETURNED result set — raise limit or narrow the query for full ordering. Not applicable to aggregate records. | |
| limit | No | Max inline results (default 100, hard max 5000). | |
| query | Yes | Sumo Logic query text (NON-aggregate — raw messages only). | |
| since | No | Cursor from the previous sumo_new_since response (epoch ms). Omit on the first call. | |
| dedupe | No | Group repeated messages within the RETURNED page by (level, signature) — timestamps/UUIDs/hex/numbers are normalized away — rendering "first_ts..last_ts LEVEL ×N message". Raise limit for broader grouping (only fetched rows are grouped). With detail:"raw", each group keeps one verbatim _raw exemplar. | |
| detail | No | Output verbosity (default compact). | |
| fields | No | Explicit field projection from the flattened namespace (level/request_id always kept). | |
| format | No | Output mode (default text). | |
| lookback | No | Baseline window when `since` is absent, e.g. "15m", "1h" (units s/m/h/d; default "15m"). | |
| maxMessageChars | No | Safety cap for the message field (default 10000); the message is never truncated by default. |