topic Re: Splunk dashboard for printer statistics in Deployment Architecture

Splunk dashboard for printer statistics

sbattista09 — Thu, 05 May 2016 14:44:55 GMT

has anyone done this before? i want to make a report that will have 4 columns (print server, print queue, documents printed in last 30 days, date last printed to) and will contain all printers from the servers. The documents printed will just be an incrementing number and the date last printed to can just be mm/dd/yyyy. If the columns could be sorted from smallest to largest on date last printed.

Re: Splunk dashboard for printer statistics

Richfez — Thu, 05 May 2016 15:41:42 GMT

If you could include some of the logs you have, that might make it easier for someone to help!

Re: Splunk dashboard for printer statistics

woodcock — Thu, 05 May 2016 16:33:28 GMT

If you have the raw data, this should be trivial.

Re: Splunk dashboard for printer statistics

sbattista09 — Tue, 29 Sep 2020 10:15:38 GMT

I made this this into a two panel dashboard,

panel1;

[text box for field1] [text box for field4]  [text box for field5] 
index=index1 host="print_server1" OR host="print_server2"  "was printed"  | rex field=_raw "\was\s\w\w\w\w\w\w\w\s\w\w\s(?P<Printers>\w+\d\d)"| Search Printers=*$field4$*  AND host=*$field5$*| stats count by _time Printers host| Where count < $field1$| Rename count as Count | Sort -Count

panel2;

index=index1  host="print_server1" OR host="print_server2"  "was printed"   | rex field=_raw "\was\s\w\w\w\w\w\w\w\s\w\w\s(?P<Printers>\w+\d\d)"|timechart count by Printers useother=f usenull=f

08/10/1850 10:00:01 AM
LogName=System
SourceName=PrintSpooler
EventCode=10
EventType=4
Type=Information
ComputerName=print_server1
User=User1
TaskCategory=None
OpCode=None
RecordNumber=12345
Keywords=Classic
Message=Document 1, Reports - lolz owned by lolz was printed on Printer_1 through port 1.1.1.1 . Size in bytes: 15415151515.