topic Re: Need help to generate report based in table format in Alerting

Need help to generate report based in table format

syedak — Fri, 02 Feb 2018 04:20:22 GMT

Need help to generate report based in table format in below format.

Hostname OS IPaddress LastLogReceived

SRV1 Win 10.x.x.x 25/01/2018
SRV2 Win 10.x.x.x 25/01/2018

SRV3 Linux 10.x.x.x 25/01/2018

TotalSRV = 3

Re: Need help to generate report based in table format

mayurr98 — Fri, 02 Feb 2018 06:30:30 GMT

hey, could you provide some sample events?

If all of the columns are already extracted then with the columns provided then you can try something like this

index=<your_index> | table Hostname OS IPaddress LastLogReceived

let me know if this helps!

Re: Need help to generate report based in table format

syedak — Fri, 02 Feb 2018 07:46:20 GMT

Hi Mayurr98,
Thanks for the help.

I need something like this in my report

|Srv1 | 10.x.x.x| Windows|

|Srv2 | 10.x.x.x| Windows|
|Srv3 | 10.x.x.x| Windows|
|Tot Srv = 3(count of servers)|

Below is my search which i used for daily report, on top of this query i also need to count number of hostname that are present in this search result.

index= _internal fwdType ="*"
|eval lastUpdate=strftime(_time, "%d - %m -%Y %H:%M:%S")
|dedup hostname
| sort hostname asc
| table hostname, os, sourceHost, lastupdate

Re: Need help to generate report based in table format

mayurr98 — Fri, 02 Feb 2018 12:53:56 GMT

Try this :

index=_internal fwdType="*" 
| eval lastUpdate=strftime(_time,"%d-%m-%Y %H:%M:%S") 
| dedup hostname 
| stats dc(hostname) as dc_count by hostname, os, sourceHost, lastUpdate 
| sort hostname asc 
| addcoltotals dc_count labelfield=hostname label="Total SRV"

Re: Need help to generate report based in table format

syedak — Mon, 05 Feb 2018 03:26:43 GMT

Thanks Mayurr98.
Worked for me to certain level.