Alerting

Need to create and dashboard where the end user can request for extension of threshold increase.

siddharthparuch
New Member

In the above dashboard, i want to input the Extension drop down box in each row of the report visible below in the coulmn of Extension.
can anyone please help me out with it.

<form>
      <label>User Long Checkouts Report Central DB_Sid</label>
      <description>This dashboard shows the long license checkouts generated in the last 15 mins</description>
      <search id="BS_longLicenseCheckOuts">
        <query>|tstats latest(Main.licCount) as licCount, latest(Main.city) as city,latest(Main.geographicalRegion) as geographicalRegion, latest(Main.region) as region, latest(Main.active) as active, latest(Main.serverType) as serverType, latest(Main.serverPurpose) as serverPurpose from datamodel=EDA_RealTime_userV2 where (nodename = Main)  Main.vendorDaemon=MLM Main.user=$user$ summariesonly=false by _time span=10m, Main.feature ,Main.user, Main.hostFile, Main.startTime, Main.vendorDaemon , Main.execHost
    | rename Main.startTime as startTime, Main.feature as feature, Main.hostFile as licServer, Main.user as user, Main.vendorDaemon as vendorDaemon, Main.execHost as execHost 
    | join type=left feature vendorDaemon    
     [| inputlookup LongCheckout_Alert_Features.csv    
     | rename vendor as vendorDaemon, Days as threshold] 
    | eval now=now() 
    | eval checkoutDays=round((now-startTime)/86400)
    | eval startTimeConverted=strftime(startTime,"%d-%m-%Y %H:%M:%S")
    | eval percentageThreshold = round((checkoutDays/threshold)*100) 
    | where threshold NOT NULL AND checkoutDays > threshold 
    | search checkoutDays!=365
    | lookup local=t ldap_people.csv cn as user OUTPUT mail, Country
    | eval mail=coalesce(mail,"mail.addressunknown@nxp.com")|  stats values(execHost) as "User HostName", values(licServer) as "License Server", values(licCount) as "No.Licenses", values(checkoutDays) as "Checkout DurationDays", values(vendorDaemon) as "VendorDaemon", values(threshold) as "Threshold Limit" by "user", feature, startTimeConverted
    | rename user as "User", feature as "FeatureName", startTimeConverted as "CheckoutDate"| table "User" , "FeatureName" , "VendorDaemon", "User HostName" , "License Server" , "CheckoutDate" , "No.Licenses" , "Checkout DurationDays", "Extension"</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <fieldset submitButton="true" autoRun="true">
        <input type="text" token="user" searchWhenChanged="True">
          <label>User ID</label>
        </input>
      </fieldset>
      <row>
        <panel>
          <title>Long Checked out Licenses</title>
          <input type="dropdown" token="extension">
            <label>Extension</label>
            <choice value="">Any</choice>
            <choice value="8">8</choice>
            <choice value="6">6</choice>
            <choice value="4">4</choice>
            <choice value="2">2</choice>
            <default></default>
            <search>
              <query/>
            </search>
          </input>
          <table>
            <search base="BS_longLicenseCheckOuts">
              <query/>
            </search>
            <option name="count">100</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="percentagesRow">false</option>
            <option name="rowNumbers">false</option>
            <option name="totalsRow">false</option>
            <option name="wrap">true</option>
            <format type="color" field="User Percentage">
              <scale type="threshold">20,70</scale>
            </format>
          </table>
        </panel>
      </row>
    </form>
0 Karma

brschaefer_splu
Splunk Employee
Splunk Employee

Take a look at this app for an example of how to proceed:
https://splunkbase.splunk.com/app/3647/

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...