Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About canalesjac
canalesjac
Path Finder
Member since:
11-02-2012
10-20-2020
Community Statistics
| Posts | 15 |
| Solutions | 3 |
| Karma Given | 1 |
| Karma Received | 14 |
| Member Since | 11-02-2012 |
Activity Feed
- Got Karma for Re: How do i get Epic Hyperspace logs to Splunk with Syslog?. 07-26-2022 09:10 PM
- Got Karma for Re: How can I monitor VMware Horizon View with Splunk?. 09-10-2021 02:39 PM
- Got Karma for Re: How do i get Epic Hyperspace logs to Splunk with Syslog?. 08-04-2021 12:22 PM
- Got Karma for Re: How can I monitor VMware Horizon View with Splunk?. 10-20-2020 12:43 PM
- Got Karma for Re: How can I monitor VMware Horizon View with Splunk?. 10-20-2020 12:43 PM
- Got Karma for How can I monitor VMware Horizon View with Splunk?. 10-20-2020 12:42 PM
- Posted Re: How can I monitor VMware Horizon View with Splunk? on Splunk Enterprise Security. 10-20-2020 09:04 AM
- Posted Re: How can I monitor VMware Horizon View with Splunk? on Splunk Enterprise Security. 10-20-2020 09:01 AM
- Posted Re: How do i get Epic Hyperspace logs to Splunk with Syslog? on Splunk Enterprise Security. 07-16-2020 02:57 PM
- Posted How do i get Epic Hyperspace logs to Splunk with Syslog? on Splunk Enterprise Security. 07-16-2020 11:50 AM
- Tagged How do i get Epic Hyperspace logs to Splunk with Syslog? on Splunk Enterprise Security. 07-16-2020 11:50 AM
- Tagged How do i get Epic Hyperspace logs to Splunk with Syslog? on Splunk Enterprise Security. 07-16-2020 11:50 AM
- Tagged How do i get Epic Hyperspace logs to Splunk with Syslog? on Splunk Enterprise Security. 07-16-2020 11:50 AM
- Tagged How do i get Epic Hyperspace logs to Splunk with Syslog? on Splunk Enterprise Security. 07-16-2020 11:50 AM
- Posted Re: How do I get Solarwinds data into Splunk with Syslog? on Splunk Enterprise Security. 07-16-2020 11:42 AM
- Posted Re: How can I monitor VMware Horizon View with Splunk? on Splunk Enterprise Security. 07-16-2020 11:28 AM
- Got Karma for How can I monitor VMware Horizon View with Splunk?. 06-05-2020 12:51 AM
- Got Karma for How can I monitor VMware Horizon View with Splunk?. 06-05-2020 12:51 AM
- Got Karma for Re: How can I monitor VMware Horizon View with Splunk?. 06-05-2020 12:51 AM
- Got Karma for Re: How can I monitor VMware Horizon View with Splunk?. 06-05-2020 12:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 |
10-20-2020
09:04 AM
1 Karma
@aftasuncion make sure that you have syslog configuration set on each Horizon View Connection Server in the Admin Console. Some people confuse this config with the ESXi Syslog which is a different log. The fields are all from the default HV syslog and there are no custom extractions. You may need to look at the raw data first to see if you are receiving the correct logs first.
... View more
10-20-2020
09:01 AM
@abhisom all the graphs are based on default fields from the syslog. I did not have to create any custom extractions. You can create a time series graph for users connected by copying one of the panels and adding a timechart order by user name.
... View more
07-16-2020
02:57 PM
2 Karma
I found that Epic Hyperspace does have a configuration to set logs to be sent to your SIEM by Syslog. Here is an example of a Epic Event Activity Dashboard. Epic Event Activity Dashboard Epic Event Activity Dashboard Continue In order to configure multiple SIEMs you have to be running Epic November 2018. Please see "Epic User Auditing Guide" >Access History>Sending Auditing Events to SIEMs. Very simple setup. Step 1) You will need to have Epic Hyperspace installed. Step 2) You will need to have Splunk installed. Step 3) Create a new dashboard and call it "Epic Event Activity ". Select Edit Dashboard. Select Source. Copy and paste XML code attached. Select save dashboard. Step 3) Configure your Splunk with a custom index. I call this index "Epic". I created a syslog data input with a TCP port 532. You can use your port such as default syslog 514 UDP. Step 4) Configure your Epic instance to use the SIEM IP and Port. Epic Hyperspace Login Epic Event Activity Dashboard Source Code <form theme="dark">
<label>EPIC Event Activity</label>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="tok.time">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="tok.shost">
<label>Epic Environment</label>
<fieldForLabel>shost</fieldForLabel>
<fieldForValue>shost</fieldForValue>
<search>
<query>index=epic shost="*" | stats count by shost</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<single>
<search>
<query>index=epic shost=$tok.shost$ | stats count</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-1h</option>
<option name="underLabel">Events</option>
</single>
<single>
<search>
<query>index=epic shost=$tok.shost$ | timechart count</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="underLabel">Events Over Time</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Events By Environment</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | stats count by shost</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events By Environment</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | top limit=10 shost</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events by Environment</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | timechart count by shost</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">area</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Events By Service Category</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | stats count by SERVICECATEGORY</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events By Service Category</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | top limit=10 SERVICECATEGORY</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events by Service Category</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | timechart count by SERVICECATEGORY</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Events By Service Type</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | stats count by SERVICETYPE</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events By Service Type</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | top limit=10 SERVICETYPE</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events by Service Type</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | timechart count by SERVICETYPE</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">area</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Events By Service Name</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | stats count by SERVICENAME</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events By Service Name</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | top limit=10 SERVICENAME</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events by Service Name</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | timechart count by SERVICENAME</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Events By User</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | stats count by suser</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events By User</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | top limit=10 suser</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Events by User</title>
<chart>
<search>
<query>index=epic shost=$tok.shost$ | timechart count by suser</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form> https://www.linkedin.com/in/canalesj/ https://twitter.com/Canalesjj
... View more
07-16-2020
11:50 AM
I would like retrieve data from Epic Hyperspace Logs via Syslog. I know you can use the Epic APIs like FIHR but I would like to use Syslog instead.
... View more
Labels
- Labels:
-
investigation
07-16-2020
11:42 AM
Thank you all for your advice, I was able to find a way to get data from SolarWinds into Splunk. I’m using a Syslog event in a Node Down Trigger. I created a Device Availability Dashboard by using Splunk. Here is the example CONTOSO Node Availability Dashboard : Splunk Node Availability Dashboard Step 1) You will need to have Solarwinds NPM installed. Step 2) You will need to have Splunk installed. Step 2.1) Install the Splunk calendar heat map. Step 2.2) Create a new dashboard and call it "Contoso Node Availability". Select Edit Dashboard. Select Source. Copy and paste XML code attached. Select save dashboard. Step 3) Configure your Splunk with a custom index. I call this index "Solarwinds". I created a syslog data input with a TCP port 532. You can use your port such as default syslog 514 UDP. Step 4) Enabled your "Node is down" Alert in Solarwinds NPM Orion. You can do this by going to "Manage Alerts" section. Step 5) Add a Trigger Action to your Alert. Choose Send A Syslog Message. Provide the Splunk Syslog Forwarder IP and Port. Make sure that you the exact message tags so that the Splunk dashboard is able to find the indexed data. Solarwinds Trigger Action Step 6) Add a Reset Action to your Alert. Choose Send A Syslog Message. Provide the Splunk Syslog Forwarder IP and Port. Make sure that you the exact message tags so that the Splunk dashboard is able to find the indexed data. Solarwinds Reset Action Step 7) You can choose to test your alert with Solarwinds or reboot the device you are monitoring to trigger the alert. I configure my alerts to send email for both trigger and reset to make sure that i know that the alert is working as expected. Step 😎 You can run the following SPL search to see if there is any data being collected. If you have successfully returned events you will now are able to run the full dashboard. Spunk Transaction Stitched Contoso Node Availability Source Code <form theme="dark">
<label>Contoso Node Availability</label>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="tok.time">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Availability 12 Hours</title>
<viz type="calendar_heatmap_app.calendar_heatmap">
<search>
<query>index=solarwinds alert_name="Node is down" | transaction node_name startswith="Trigger" endswith="Reset" | timechart span=1m sum(closed_txn)</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="calendar_heatmap_app.calendar_heatmap.cellPadding">2</option>
<option name="calendar_heatmap_app.calendar_heatmap.cellSize">10</option>
<option name="calendar_heatmap_app.calendar_heatmap.cellStyle">circle</option>
<option name="calendar_heatmap_app.calendar_heatmap.legendType">uniform</option>
<option name="calendar_heatmap_app.calendar_heatmap.maxColor">#dc4e41</option>
<option name="calendar_heatmap_app.calendar_heatmap.minColor">#f8be34</option>
<option name="calendar_heatmap_app.calendar_heatmap.numOfBins">3</option>
<option name="calendar_heatmap_app.calendar_heatmap.showLegend">1</option>
<option name="calendar_heatmap_app.calendar_heatmap.splitMonths">1</option>
<option name="drilldown">none</option>
<option name="height">200</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
<row>
<panel>
<title>Availability 14 Days</title>
<viz type="calendar_heatmap_app.calendar_heatmap">
<search>
<query>index=solarwinds alert_name="Node is down" | transaction node_name startswith="Trigger" endswith="Reset" | timechart span=1h sum(closed_txn)</query>
<earliest>-14d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="calendar_heatmap_app.calendar_heatmap.cellPadding">2</option>
<option name="calendar_heatmap_app.calendar_heatmap.cellSize">10</option>
<option name="calendar_heatmap_app.calendar_heatmap.cellStyle">circle</option>
<option name="calendar_heatmap_app.calendar_heatmap.legendType">uniform</option>
<option name="calendar_heatmap_app.calendar_heatmap.maxColor">#dc4e41</option>
<option name="calendar_heatmap_app.calendar_heatmap.minColor">#f8be34</option>
<option name="calendar_heatmap_app.calendar_heatmap.numOfBins">3</option>
<option name="calendar_heatmap_app.calendar_heatmap.showLegend">1</option>
<option name="calendar_heatmap_app.calendar_heatmap.splitMonths">1</option>
<option name="drilldown">none</option>
<option name="height">164</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
<row>
<panel>
<title>Availability 12 Months</title>
<viz type="calendar_heatmap_app.calendar_heatmap">
<search>
<query>index=solarwinds alert_name="Node is down" | transaction node_name startswith="Trigger" endswith="Reset" | timechart span=1d sum(closed_txn)</query>
<earliest>-12mon</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="calendar_heatmap_app.calendar_heatmap.cellPadding">2</option>
<option name="calendar_heatmap_app.calendar_heatmap.cellSize">10</option>
<option name="calendar_heatmap_app.calendar_heatmap.cellStyle">circle</option>
<option name="calendar_heatmap_app.calendar_heatmap.legendType">uniform</option>
<option name="calendar_heatmap_app.calendar_heatmap.maxColor">#dc4e41</option>
<option name="calendar_heatmap_app.calendar_heatmap.minColor">#f8be34</option>
<option name="calendar_heatmap_app.calendar_heatmap.numOfBins">3</option>
<option name="calendar_heatmap_app.calendar_heatmap.showLegend">1</option>
<option name="calendar_heatmap_app.calendar_heatmap.splitMonths">1</option>
<option name="drilldown">none</option>
<option name="height">201</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
<row>
<panel>
<title>Availability Top 24 Last 30 Days</title>
<chart>
<search>
<query>index=solarwinds alert_name="Node is down" | transaction node_name startswith="Trigger" endswith="Reset" | stats count(node_name) AS Down by node_name | sort -Down limit=25</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form> https://www.linkedin.com/in/canalesj/ https://twitter.com/Canalesjj
... View more
07-16-2020
11:28 AM
@jqheI do not have a TA sorry.
... View more
04-22-2020
11:24 PM
Yes, all default.
... View more
04-09-2020
03:53 PM
VMware Horizon View Security Dashboard On Splunk
... View more
04-09-2020
12:43 AM
8 Karma
I found the answer to my question. VMWare Horizon can send data to Splunk as Syslog target. You can have your connection servers configured to send logs to Splunk. You can configure a Syslog input and create a VMWare index on port 514. You can then create custom dashboards. I recommend using Splunk universal forwarder dedicated for your Syslog input. You can find more information and an example dashboard in this post. Just create two new dashboards and import the attached xml dashboards.
<form theme="dark">
<label>CONTOSO Horizon View Login Diagnostics</label>
<description>User statistics for you Horizon View farm</description>
<fieldset autoRun="true" submitButton="true">
<input type="time" searchWhenChanged="true" token="tok.time">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="tok.pool">
<label>Pool</label>
<choice value="*">All</choice>
<choice value="*Windows 7">Windows 7</choice>
<choice value="*Windows 10">Windows 10</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>DesktopDisplayName</fieldForLabel>
<fieldForValue>DesktopDisplayName</fieldForValue>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=* earliest=$tok.time.earliest$ latest=$tok.time.latest$ | stats count by DesktopDisplayName| sort - count |fields - count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<title>Desktop Event Types Over Time</title>
<chart>
<search>
<query>index=vmware EventType!=Null | timechart count by EventType</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">bottom</option>
<option name="refresh.display">progressbar</option>
</chart>
<table>
<search>
<query>index=vmware EventType!=Null | stats count by EventType</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Desktop Logins Over Time</title>
<chart>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName="*" | timechart count(DesktopDisplayName) by DesktopDisplayName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">area</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">bottom</option>
</chart>
<table>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName="*" | stats count(DesktopDisplayName) by DesktopDisplayName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>Desktop Shutdown Over Time</title>
<chart>
<search>
<query>index=vmware EventType=AGENT_SHUTDOWN DesktopDisplayName="*" | timechart count(DesktopDisplayName) by DesktopDisplayName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">area</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">bottom</option>
</chart>
<table>
<search>
<query>index=vmware EventType=AGENT_SHUTDOWN DesktopDisplayName="*" | stats count(DesktopDisplayName) by DesktopDisplayName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
<form theme="dark">
<label>CONTOSO Horizon View Login Activity</label>
<description>User statistics for you Horizon View farm</description>
<fieldset autoRun="true" submitButton="true">
<input type="time" searchWhenChanged="false" token="tok.time">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="tok.pool">
<label>Pool</label>
<choice value="*">All</choice>
<choice value="*Windows 7">Windows 7</choice>
<choice value="*Windows 10">Windows 10</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>DesktopDisplayName</fieldForLabel>
<fieldForValue>DesktopDisplayName</fieldForValue>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=* earliest=$tok.time.earliest$ latest=$tok.time.latest$ | stats count by DesktopDisplayName| sort - count |fields - count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<single>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$| stats count(_raw) as "Total Connections"</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="trendInterval">-24h</option>
<option name="underLabel">Total Logins</option>
</single>
<single>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats dc(UserDisplayName) as "Total Users"</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="trendInterval">-24h</option>
<option name="underLabel">Total Users</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Frequent User Logins</title>
<chart>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats count(UserDisplayName) by UserDisplayName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
<table>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats count(UserDisplayName) as Logins, count(UserDisplayName) as Percent by UserDisplayName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="count">12</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<title>Frequent Pool Logins</title>
<chart>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats count(DesktopDisplayName) by DesktopDisplayName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
<table>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats count(DesktopDisplayName) as Logins by DesktopDisplayName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="count">12</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel>
<title>Frequent User Logins</title>
<chart>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats count(MachineName) by MachineName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
<table>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats count(MachineName) as Machines, count(MachineName) as Percent by MachineName</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="count">12</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<title>Frequent Connection Managers</title>
<chart>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats count(host) by host</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
<table>
<search>
<query>index=vmware EventType=AGENT_CONNECTED DesktopDisplayName=$tok.pool|s$ | stats count(host) as Logins by host</query>
<earliest>$tok.time.earliest$</earliest>
<latest>$tok.time.latest$</latest>
</search>
<option name="count">12</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
... View more
04-09-2020
12:21 AM
3 Karma
I’m running VMWare Horizon View 7 in my organization. Now with COVID-19 Shelter in place we all need to WFH. How do I monitor user activity and know what the user experience is when connecting to VDI? I know VMWare Horizon View has vRealize Operations Manager for View but it’s limited.
... View more
Labels
- Labels:
-
other
02-18-2020
10:43 PM
I found the answer to my question. ExtraHop Reveal(x) can send data to Splunk as a SIEM Syslog target. You can create a ExtraHop ML Detection Trigger and send it to your Splunk target. You can configure a Syslog input and create an ExtraHop index on port 514. You can then create custom dashboards. I recommend using Splunk universal forwarder dedicated for your Syslog input. You can find more information and an example the ExtraHop forum.
http://bit.ly/2vDn5lB
... View more
02-18-2020
05:10 PM
I would like retrieve data from Solarwinds when events trigger via Syslog. I know you can use the Solarwinds Splunk App but I would like to use Syslog instead.
... View more
02-18-2020
05:00 PM
The ExtraHop Splunk App may not be what you are most interested in. If what you want is to build dashboards or reports on ExtraHop wire data, you need to configure Splunk as your Syslog SIEM entry in ExtraHop. You can then build triggers to send custom fields and values to Splunk.
Check out this article on ExtraHop Forum
ExtraHop To Splunk Article
... View more
02-18-2020
04:40 PM
I would like to create a dashboard in Splunk on my ExtraHop ML security detections. How do I do this?
... View more
11-02-2012
11:27 PM
Does anyone know how to get a report of server processes cpu over time?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-20-2020
12:37 PM
|
Karma from
