I want to start by saying I’ve never worked for a company where most of its employees actually use the product they’ve created to help them do their jobs better; from our DevOps engineers to our product managers, from QA to support, and even our customer success team. It’s a really unique situation to be in. Internally, we describe this behavior as “using Sumo on Sumo.”
As you may have already guessed, the Sumo Logic service generates its own set of custom logs and messages. Using a plethora of local collectors running on each of our Amazon EC2 instances, we send our logs to a specific account accessible only to internal employees. Within this account, we use our analytics engine to monitor our service’s health, diagnose issues, and highlight potential outages. I never thought I would say this, but dog food actually tastes pretty darn good. Yum.
Furthermore, our logs actually contain vital information about how each user interacts with Sumo Logic. Reviewing this usage data from time to time is essential to our business. Our customer success team’s primary responsibility is to ensure that all of Sumo Logic’s customers are getting value from their purchase. Is there a tool better fit to analyze these usage statistics than our own? I think not.
As a customer success manager, I can quickly find answers to the following questions:
- Who is logging in or not logging in?
- How much data is each customer ingesting and how much of it are they scanning?
- Which features are being utilized most heavily or less frequently?
- What queries are being executed and by whom?
- Is search performance a problem on an account?
Below are some of the key Sumo Logic features that we use rather extensively.
SCHEDULED SEARCHES AND ALERTS
We use scheduled searches as a mechanism to provide us early warnings. The alerts that are triggered are what we use to reach out to specific customers. For example, we track customers that don’t have any recorded logins over the last two weeks or those customers that are sending us more data than their plan size calls for. We have a mixed bag of alerts that fire on a recurring basis, representing both risks and opportunities. The key thing is that we are alerted using “good” and “bad” indicators since both are actionable and are equally rewarding. This phrase often gets thrown around here (and for good reason) … “you can’t forget to water the green grass!” We have to find time to keep our happy customers happy and ensure we’re not spending all of our time solely focused on fighting fires.
DASHBOARDS
Sumo Logic dashboards give our team a way to calculate, consolidate, and display customer data in a single view containing multiple search panels. These panels can update automatically when they are in ‘live mode.’ On the walls of our customer success pod here in Redwood City, we have monitors that display information on failed searches, affected customers, and metrics showing the health of our infrastructure. These dashboards look very similar to what you would see in a typical NOC or SOC. Here’s an example of one that monitors interactive searches across our different nodes:
A Dashboard to Help Monitor Search Performance
While keeping a dashboard in ‘live mode’ is helpful, the added ability to interact with the data on our dashboards is what provides tremendous value to our team. For example, we created a “Customer Account Overview” dashboard where we can easily swap from one customer to another simply by updating a single parameter. Once we enter in a unique organization ID, all of the panels are automatically refreshed to display data for the account that was keyed in. This allows us to easily pull up usage statistics when we’re on a customer phone call or when we’re in team meetings. Below is a screenshot of this dashboard. Pretty nifty, right?
A Dashboard Displaying Customer Usage Details
THE SEARCH API AND OPEN SOURCE
On a weekly basis, we generate an Excel report to give us quick insight on all of our customers. With over 1,000 customers and growing, we know we won’t have a chance to work with all of them every day. Therefore, every Monday, we review these reports to prioritize our campaigns based on a variety of weighted usage metrics.
How are these reports generated? We developed a java app called the Sumo Report Generator. When invoked, the app reads from a JSON file containing a predefined set of Sumo queries to be executed. The java app calls the Sumo Logic Search API and consolidates all of the query results into a single spreadsheet. In the past, this process was entirely manual and took a few hours, but now it takes only five minutes.
And guess what the best part is? We’ve made this sucker available for you to use! Use this link to find the Sumo Report Generator on GitHub.
SUMMARY
Using Sumo Logic to help you manage your own customer base is certainly a valid use case and is definitely something to consider. Oftentimes, log messages are used only to provide insight on the health of a particular device or service, but they can also provide intelligence about your users as well. There can be a lot of value in analyzing your logs if you capture the right type of messages and events. This is how we use Sumo on Sumo.
If you’re hoping to accomplish something similar with Sumo Logic and would like to discuss any of the configurations above, we’d love to show you what we’ve done. Please contact us at customer-success@sumologic.com.
