All Apps and Add-ons

XenDesktop -> license report -> just one product

domteich
Explorer

Hi.

I try to implement the Splunk App for Citrix XenDesktop and got a problem with the license report.
There is just one produkt visible. There are "first" operations in the search string:

`citrix_licensing` | `citrix_license_type` | `citrix_license_product` | rename Product as Prod | stats first(ProductName) as Product first(Installed) as Installed first(Available) as Available first(InUse_pct) as InUse_pct first(TypeName) as Type by InUse Prod
_time

The output of "citrix_licensing | citrix_license_type | citrix_license_product" gives me a lot of products in one event.

Thanks,
Dominic

0 Karma

sven_schlitt
New Member

Hi Brandon,
have you found a solution for the problem? I have the same problem.
As I can see on the App screenshots it should work.
My RAW Data looks like this:

Event 1
07.17.2012 05:29:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="20" InUse="0" ...
07.17.2012 05:29:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="30" InUse="0" ...

Event 2
07.17.2012 05:27:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="20" InUse="0" ...
07.17.2012 05:27:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="30" InUse="0" ...

Is there any problem with the field extraction or event linebreaking?

Thanks Sven

0 Karma

bsonposh
Communicator

I have and it will be fixed in the next release. The problem is that stats first() command that I used doesn't work as expected so I have changed it to use stats lastest() which should do what is expected.

Now your issues seems different and looks like linebreaking isn't acting as it should. It should break on each date.

If you can email me I we can setup a time to see whats going on.

0 Karma

bsonposh
Communicator

The purpose of using "first" in this case is to reduce duplicates. The license TA collects data frequently so you will have each item multiple times. The stats first(something) should collect the first value of "something" by Prod.

If you can send me an email perhaps we can setup a GotoMeeting to figure out whats going on.

0 Karma

domteich
Explorer

Where can I find your email address?

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...