Follow Run your search through Sumo Logic’s Search Job API: create a job, wait until it has gathered all results, then page through the messages. Each message carries the original log line in _raw. The Messages tab in the UI can export results too, but not in a format LogTotal reads today.
Sumo Logic is a common cloud SIEM and log platform, and a natural place to pull an investigation slice from. Prime Core has 23,391 detection rules for Sumo Logic, mapped to 664 MITRE ATT&CK techniques. Below is how to get raw logs out, sanitize them, and investigate them for free in LogTotal.
Before you start
An access key. Create an access ID and key in Sumo Logic. The key acts with your role’s permissions, so the role needs to be able to run searches on the data you want.
The right API endpoint. Sumo Logic runs several deployments, and each has its own API host: api.sumologic.com for US1, api.us2.sumologic.com, api.eu.sumologic.com and so on. Match it to the URL you use to log in. A wrong deployment gives you a 401 that looks like a bad key.
Cookies. The Search Job API needs cookies kept between calls, because a job lives on a specific backend node. Without a cookie jar, follow-up calls can fail to find the job.
Limits. A job returns a capped number of messages, and each page holds up to 10,000. Keep time windows tight.
Export with the Search Job API
API="https://api.sumologic.com/api/v1"
AUTH="$SUMO_ACCESS_ID:$SUMO_ACCESS_KEY"
JAR=$(mktemp)
# 1. create the search job
JOB=$(curl -sS -u "$AUTH" -c "$JAR" -b "$JAR" -H 'Content-Type: application/json' \
-X POST "$API/search/jobs" -d '{
"query": "_sourceCategory=linux/secure _sourceHost=web-03",
"from": "2026-10-19T00:00:00", "to": "2026-10-20T00:00:00",
"timeZone": "UTC"
}' | jq -r '.id')
# 2. wait until all results are gathered
until curl -sS -u "$AUTH" -c "$JAR" -b "$JAR" "$API/search/jobs/$JOB" \
| jq -e '.state == "DONE GATHERING RESULTS"' >/dev/null; do sleep 5; done
# 3. page through the messages, keeping the raw lines
COUNT=$(curl -sS -u "$AUTH" -c "$JAR" -b "$JAR" "$API/search/jobs/$JOB" | jq '.messageCount')
for ((off=0; off<COUNT; off+=10000)); do
curl -sS -u "$AUTH" -c "$JAR" -b "$JAR" "$API/search/jobs/$JOB/messages?offset=$off&limit=10000" \
| jq -r '.messages[].map._raw'
done > web-03_sumo_1019.log
# 4. clean up
curl -sS -u "$AUTH" -c "$JAR" -b "$JAR" -X DELETE "$API/search/jobs/$JOB" >/dev/null
Keep the query to a plain filter. Queries with aggregation operators return records, not messages, and records don’t carry _raw. For structured output, write jq -c ‘.messages[].map’ instead, which gives one JSON object per line with all fields.
If a job is cancelled, the wait loop never ends. Add a check for CANCELLED if you script this for regular use.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 Unauthorized | Wrong deployment endpoint, or a bad key | Match the API host to your login URL |
| Job “not found” on follow-up calls | Cookies not kept between calls | Use a cookie jar (-c / -b) |
| _raw is empty | The query aggregates | Use a plain filter query |
| Fewer messages than expected | Per-job limit | Split the time window |
| 429 Too Many Requests | API rate limit | Slow down; fewer parallel jobs |
FAQ
What about Sumo Logic Cloud SIEM signals and insights?
Those are detections, not logs. For LogTotal, export the log messages behind them.
Can I search by receipt time instead of message time?
Yes, with “byReceiptTime”: true in the job body. That helps when sources send late or with wrong clocks.
