I've got to get a report going that will show us multiple cloud site statistics for XenDesktop in a single report. What makes this a challenge is if I use sum() it adds all stats within the search time, and since the script reports in multiple times an hour, the stats would then be off...big time. So ideally I would like to avg() the stats from both Site servers, then add them together to form the Site table. Here's what I have so far:
This search:
index=CitrixXenDesktop source=XenDesktop:Get-XDDesktopGroup7.ps1 sourcetype=XenDesktop:desktopgroup
| eval DesktopsOff = TotalDesktops-(DesktopsUnregistered+DesktopsAvailable+DesktopsDisconnected+DesktopsInUse)
| stats max(DesktopsAvailable) as Available max(DesktopsInUse) as InUse max(DesktopsDisconnected) as Disconnected max(DesktopsUnregistered) as Unregistered max(DesktopsOff) as Off by host
…gives these results:
![
This is close, but I need to add the stats for each Site server and get something like this:
If you have a way to get the site names from the host names then you could change the stats
command to by site
instead of by host
and have your desired results. A simplistic example would be:
index=CitrixXenDesktop source=XenDesktop:Get-XDDesktopGroup7.ps1 sourcetype=XenDesktop:desktopgroup
| eval DesktopsOff = TotalDesktops-(DesktopsUnregistered+DesktopsAvailable+DesktopsDisconnected+DesktopsInUse)
| eval site=substr(host,1,5) |
| stats max(DesktopsAvailable) as Available max(DesktopsInUse) as InUse max(DesktopsDisconnected) as Disconnected max(DesktopsUnregistered) as Unregistered max(DesktopsOff) as Off by site
Append this to the end of your search. You may have to tweak the regex to match your data. But the idea is to extract the site name from host field and group sum by site.
... | rex field=Host "(?<Site>Site\d+)" | stats sum(*) as * by Site