search_logs
Execute a Sumo Logic log search and retrieve results, handling both aggregated and raw log queries with configurable time ranges and limits.
Instructions
Execute a Sumo Logic log search and return results.
Handles the full search lifecycle: creates a job, polls until done, fetches results, and cleans up. For aggregation queries (containing count, sum, avg, group by, etc.) returns aggregated records. For raw queries returns log messages.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results to return | |
| query | Yes | Sumo Logic search query (same syntax as the Sumo UI) | |
| timeout | No | Max seconds to wait for the search to complete | |
| to_time | No | End time — same formats as from_time | now |
| timezone | No | IANA timezone for interpreting from/to (e.g. 'UTC', 'America/New_York') | UTC |
| from_time | No | Start time — ISO 8601, relative (-15m, -1h, -2d), epoch ms, or 'now' | -15m |
| by_receipt_time | No | Use receipt time instead of message time |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |