XenDesktop -> license report -> just one product

[domteich]

Hi.

I try to implement the Splunk App for Citrix XenDesktop and got a problem with the license report.
There is just one produkt visible. There are "first" operations in the search string:

`citrix_licensing` | `citrix_license_type` | `citrix_license_product` | rename Product as Prod | stats first(ProductName) as Product first(Installed) as Installed first(Available) as Available first(InUse_pct) as InUse_pct first(TypeName) as Type by InUse Prod
_time

The output of "citrix_licensing | citrix_license_type | citrix_license_product" gives me a lot of products in one event.

Thanks,
Dominic

[sven_schlitt]

Hi Brandon,
have you found a solution for the problem? I have the same problem.
As I can see on the App screenshots it should work.
My RAW Data looks like this:

Event 1
07.17.2012 05:29:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="20" InUse="0" ...
07.17.2012 05:29:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="30" InUse="0" ...

Event 2
07.17.2012 05:27:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="20" InUse="0" ...
07.17.2012 05:27:14 GMT - Product="XDS_PLT_CCS" Type="Retail" Installed="30" InUse="0" ...

Is there any problem with the field extraction or event linebreaking?

Thanks Sven

[bsonposh]

I have and it will be fixed in the next release. The problem is that stats first() command that I used doesn't work as expected so I have changed it to use stats lastest() which should do what is expected.

Now your issues seems different and looks like linebreaking isn't acting as it should. It should break on each date.

If you can email me I we can setup a time to see whats going on.

[bsonposh]

The purpose of using "first" in this case is to reduce duplicates. The license TA collects data frequently so you will have each item multiple times. The stats first(something) should collect the first value of "something" by Prod.

If you can send me an email perhaps we can setup a GotoMeeting to figure out whats going on.

[domteich]

Where can I find your email address?