All Apps and Add-ons

XenDesktop -> license report -> just one product

domteich
Explorer

Hi.

I try to implement the Splunk App for Citrix XenDesktop and got a problem with the license report.
There is just one produkt visible. There are "first" operations in the search string:

`citrix_licensing` | `citrix_license_type` | `citrix_license_product` | rename Product as Prod | stats first(ProductName) as Product first(Installed) as Installed first(Available) as Available first(InUse_pct) as InUse_pct first(TypeName) as Type by InUse Prod
_time

The output of "citrix_licensing | citrix_license_type | citrix_license_product" gives me a lot of products in one event.

Thanks,
Dominic

0 Karma

sven_schlitt
New Member

Hi Brandon,
have you found a solution for the problem? I have the same problem.
As I can see on the App screenshots it should work.
My RAW Data looks like this:

Event 1
07.17.2012 05:29:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="20" InUse="0" ...
07.17.2012 05:29:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="30" InUse="0" ...

Event 2
07.17.2012 05:27:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="20" InUse="0" ...
07.17.2012 05:27:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="30" InUse="0" ...

Is there any problem with the field extraction or event linebreaking?

Thanks Sven

0 Karma

bsonposh
Communicator

I have and it will be fixed in the next release. The problem is that stats first() command that I used doesn't work as expected so I have changed it to use stats lastest() which should do what is expected.

Now your issues seems different and looks like linebreaking isn't acting as it should. It should break on each date.

If you can email me I we can setup a time to see whats going on.

0 Karma

bsonposh
Communicator

The purpose of using "first" in this case is to reduce duplicates. The license TA collects data frequently so you will have each item multiple times. The stats first(something) should collect the first value of "something" by Prod.

If you can send me an email perhaps we can setup a GotoMeeting to figure out whats going on.

0 Karma

domteich
Explorer

Where can I find your email address?

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...