Search Across Multiple Child Orgs

blog-service/2025-10-31-search.md

@@ -0,0 +1,13 @@
+---
+title: Search Across Multiple Child Orgs (MSSPs)
+image: https://help.sumologic.com/img/reuse/rss-image.jpg
+keywords:
+  - search
+  - child-orgs
+  - mssp
+hide_table_of_contents: true    
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+We're excited to announce the ability to run log search queries directly across multiple child orgs under a parent org. Previously, you could only query across one child org under a parent org. Going forward, you can now query across multiple child orgs, making it easier to dive into multi org-specific insights while staying connected at the parent org level. [Learn more](/docs/search/search-across-child-orgs).

docs/search/search-across-child-orgs.md

@@ -11,16 +11,23 @@ You can run a log search query in the selected child org under a parent org. All
 Follow the steps below to perform a child org-level search:
 
 1. **New UI.** In the main Sumo Logic menu, select **Logs** > **Log Search**. You can also click the **Go To...** menu at the top of the screen and select **Log Search**.<br/>**Classic UI.** Go to the **Log Search** page.
-1. Click the <img src={useBaseUrl('img/search/get-started-search/search-page/child-org-select-button.png')} alt="child-org-select-button" style={{border: '1px solid gray'}} width="30"/>    button to select the child org where you want to query. <br/><img src={useBaseUrl('img/search/get-started-search/search-page/child-org-dropdown.png')} alt="child-org-dropdown" style={{border: '1px solid gray'}} width="800"/>   
+1. Click the <img src={useBaseUrl('img/search/get-started-search/search-page/child-org-select-button.png')} alt="child-org-select-button" style={{border: '1px solid gray'}} width="30"/> button to select the child org where you want to query. You can either select one child org or multiple chid orgs.<br/><img src={useBaseUrl('img/search/get-started-search/search-page/child-org-dropdown.png')} alt="child-org-dropdown" style={{border: '1px solid gray'}} width="800"/>
 1. Enter the required query and click the search button to obtain the search results.
+    :::note
+    Make sure you use an aggregator and `_orgID` for multi-child org queries. For example, `* | count by _orgId` or `* | count by _orgId | sum (_count)`.
+    :::
+
+There can be two possible errors while running the multi-child org queries:
+
+- **Partial success**. This occurs when you run a query across all child orgs, and while some child orgs successfully execute, one or more encounter failures. Despite the failures, aggregate results from the successfully executed child orgs will be displayed. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
+- **Error**. This occurs when you run a query across all child orgs, and all child orgs encounter failures with no child orgs returning the successful result. To resolve the failure, refer to the audit logs (`_index=sumologic_system_events`) for detailed information on the failure query.
 
 :::note
-- We only support selecting *one* child org to perform the log search.
 - All the searches that run via the child org in the parent org would be billed under the child org account.
-- Currently, this search capability is limited only to **Log Search**.
 - Audit logs for the completed searches would appear under the child org logs.
+- Raw messages and facets are supported only for one child org query and not for multiple chid orgs query.
 :::
 
 For more information about the Log Search, refer to [Search Basics](/docs/search/get-started-with-search/search-basics/).
 
-To view your log data in a dashboard, refer to [Create a Dashboard for Child Orgs (MSSPs)](/docs/dashboards/dashboard-child-orgs).
+To view your log data in a dashboard, refer to [Create a Dashboard for Child Orgs (MSSPs)](/docs/dashboards/dashboard-child-orgs).