Deployment Architecture

Splunk dashboard for printer statistics

Contributor

has anyone done this before? i want to make a report that will have 4 columns (print server, print queue, documents printed in last 30 days, date last printed to) and will contain all printers from the servers.  The documents printed will just be an incrementing number and the date last printed to can just be mm/dd/yyyy.  If the columns could be sorted from smallest to largest on date last printed.

0 Karma
1 Solution

Contributor

I made this this into a two panel dashboard,

panel1;

[text box for field1] [text box for field4]  [text box for field5] 
index=index1 host="print_server1" OR host="print_server2"  "was printed"  | rex field=_raw "\was\s\w\w\w\w\w\w\w\s\w\w\s(?P<Printers>\w+\d\d)"| Search Printers=*$field4$*  AND host=*$field5$*| stats count by _time Printers host| Where count < $field1$| Rename count as Count | Sort -Count

panel2;

index=index1  host="print_server1" OR host="print_server2"  "was printed"   | rex field=_raw "\was\s\w\w\w\w\w\w\w\s\w\w\s(?P<Printers>\w+\d\d)"|timechart count by Printers useother=f usenull=f

08/10/1850 10:00:01 AM
LogName=System
SourceName=PrintSpooler
EventCode=10
EventType=4
Type=Information
ComputerName=printserver1
User=User1
TaskCategory=None
OpCode=None
RecordNumber=12345
Keywords=Classic
Message=Document 1, Reports - lolz owned by lolz was printed on Printer
1 through port 1.1.1.1 . Size in bytes: 15415151515.

View solution in original post

0 Karma

Contributor

I made this this into a two panel dashboard,

panel1;

[text box for field1] [text box for field4]  [text box for field5] 
index=index1 host="print_server1" OR host="print_server2"  "was printed"  | rex field=_raw "\was\s\w\w\w\w\w\w\w\s\w\w\s(?P<Printers>\w+\d\d)"| Search Printers=*$field4$*  AND host=*$field5$*| stats count by _time Printers host| Where count < $field1$| Rename count as Count | Sort -Count

panel2;

index=index1  host="print_server1" OR host="print_server2"  "was printed"   | rex field=_raw "\was\s\w\w\w\w\w\w\w\s\w\w\s(?P<Printers>\w+\d\d)"|timechart count by Printers useother=f usenull=f

08/10/1850 10:00:01 AM
LogName=System
SourceName=PrintSpooler
EventCode=10
EventType=4
Type=Information
ComputerName=printserver1
User=User1
TaskCategory=None
OpCode=None
RecordNumber=12345
Keywords=Classic
Message=Document 1, Reports - lolz owned by lolz was printed on Printer
1 through port 1.1.1.1 . Size in bytes: 15415151515.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

If you could include some of the logs you have, that might make it easier for someone to help!

0 Karma

Esteemed Legend

If you have the raw data, this should be trivial.

0 Karma