Run a Sumo Logic search (create → wait → fetch → delete)
sumo_run_searchExecute a Sumo Logic search query, wait for completion, return first N results, and auto-delete the job. Supports relative or absolute time ranges and varying verbosity levels.
Instructions
Workhorse: creates a Sumo Logic search job, waits for completion, returns the first N results, and deletes the job. Time range: exactly ONE of last (relative, e.g. "15m", "2h"; units s/m/h/d) OR both from and to (ISO-8601 like 2026-07-02T18:28:00, or epoch milliseconds).
Token levers: detail=summary (whole-job counts by the AUTO-DETECTED severity field — exact via a side-aggregate with disclosed provenance, or a loud SAMPLE label if that fails — plus a compact histogram and top message signatures; cheapest) | compact (timestamp, level, request_id, _sourcecategory, FULL message, plus method/path/status when present) | full (compact + duration_s/logger/client_ip) | raw (verbatim _raw — logs exactly as the app emitted them, including anything sensitive it logged). See the fields/dedupe/maxMessageChars params for projection, grouping, and the message-length cap.
Inline limit max 5000 — use sumo_export_results for bulk (up to 100k to a file).
Scoping in one line: filter WHERE with _sourcecategory=. Severity schemas VARY per system — let sumo_error_digest auto-detect (it discloses what it applied), or run sumo_describe_schema on a new scope and pass filter=. TRACE one request by searching its quoted correlation id with no other filters. Hostname keywords match only request logs — hunt errors by _sourcecategory. Full workflow: the "triage" MCP prompt.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: ISO-8601 or epoch ms. Requires `from`. | |
| from | No | Start time: ISO-8601 or epoch ms. Requires `to`. | |
| last | No | Relative window ending now, e.g. "15m", "2h", "1d". Mutually exclusive with from/to. | |
| sort | No | Order of returned messages by _messagetime (default "asc" = oldest→newest, best for tracing). Client-side: orders only the RETURNED result set — raise limit or narrow the query for full ordering. Not applicable to aggregate records. | |
| limit | No | Max inline results (default 100, hard max 5000). | |
| query | Yes | Sumo Logic query text. | |
| dedupe | No | Group repeated messages within the RETURNED page by (level, signature) — timestamps/UUIDs/hex/numbers are normalized away — rendering "first_ts..last_ts LEVEL ×N message". Raise limit for broader grouping (only fetched rows are grouped). With detail:"raw", each group keeps one verbatim _raw exemplar. | |
| detail | No | Output verbosity (default compact). | |
| fields | No | Explicit field projection from the flattened namespace (level/request_id always kept). | |
| format | No | Output mode (default text). | |
| extract | No | Optional per-field JSON extraction: alias → path under _raw, e.g. {"status":"log.status","user":"log.context.user"}. Appends one `| json field=_raw "<path>" as <alias> nodrop` clause per entry (chained; never the broken comma multi-extract form). Aliases must be simple identifiers; non-aggregate queries only. Extracted aliases join the flattened field namespace (combine with `fields` or ndjson/export lines). | |
| keepJob | No | Keep the job alive after returning (server keeps it polled; use the primitives to page more). Idle kept jobs are auto-deleted after ~10 minutes (YOKOZUNA_KEEPALIVE_IDLE_MINUTES); any access (status/messages/records) resets the idle timer. | |
| timeZone | No | IANA timezone for query-time parsing (default UTC). | |
| byReceiptTime | No | Search by receipt time; recommended true for very recent windows (ingestion lag). | |
| maxMessageChars | No | Safety cap for the message field (default 10000); the message is never truncated by default. |