Timeslice trend: counts over time per series (sparklines)
sumo_trendVisualize log message counts over time, segmented by log level, using a compact sparkline and per-bucket series to detect spikes and onsets. Specify a plain scope query and a time window.
Instructions
Shows WHEN things happened: buckets matching messages with | timeslice, counts per bucket split into series (default: log level via log.levelname), and renders one compact sparkline + per-bucket counts per series. Use it to spot spikes and onsets before reading messages. The query must be a plain scope — no | aggregation operators (timeslice/count are appended; one search job, auto-deleted). Time range: exactly ONE of last (relative, e.g. "15m", "2h"; units s/m/h/d) OR both from and to (ISO-8601 like 2026-07-02T18:28:00, or epoch milliseconds).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| by | No | Series dimension (default "levelname", parsed from log.levelname). "_"-prefixed = native Sumo field (e.g. _sourcecategory); "none" = one total series; anything else parses log.<by> from the JSON payload. | |
| to | No | End time: ISO-8601 or epoch ms. Requires `from`. | |
| from | No | Start time: ISO-8601 or epoch ms. Requires `to`. | |
| last | No | Relative window ending now, e.g. "15m", "2h", "1d". Mutually exclusive with from/to. | |
| query | Yes | Sumo Logic scope query (keywords + metadata filters; no | aggregation operators). | |
| interval | No | Bucket size, e.g. "30s", "5m", "1h" (units s/m/h/d). Default: auto — the smallest nice step giving ≤40 buckets over the window. | |
| timeZone | No | IANA timezone for query-time parsing (default UTC). | |
| maxSeries | No | Max series rendered, ranked by total count (default 8; the rest merge into "(other)"). | |
| byReceiptTime | No | Search by receipt time; recommended true for very recent windows (ingestion lag). |