I do not need to worry about capacity and performance. We analyze data in bursts and we don't need to scale Sumo for the occasions. I also use metrics to analyze performance during the burst period.

I live the live metrics the best. We have them integrated into our internal dashboards and it's extremely useful. I have worked with Splunk in the past, and while they provide the same out of the box log aggregation tools, Sumo logic's UX is far better. I have been able to solve complex issues, and create embedded queries for live dashboards. I know Sumo logic is cloud native and built around cloud usage. This means integrations are smoother, particularly when it comes to platforms such as AWS; scalability is built-in, there is no need for constant updates, and getting started is quicker and easier than with Splunk. Another cool feature is its ability to establish baselines and actively notify you when key metrics change after an event, such as a new software version rollout or network breach attempt. I had an error where a process was stuck in a retry loop, creating 50 times the logs created in a healthy process. This change went into our test environment on a Friday and came to light only after the alert email from Sumologic asking if this was expected.

Secure, very functional. I can find what I want, slice dice, make great julienne fries. Really this is the end all, be all solution for logging and parsing my data.