OneCIS User Training
<input type="time" token="input_time" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<panel>
<table>
<title>Time In Portal Today</title>
<search>
<query>index=trn5 source="*trn5/logs/system/access.log" NOT user="-" NOT user="USER*"
| lookup cis_users.csv userid AS user
| stats earliest(_time) as login latest(_time) as logout by username
| eval diff=logout-login
| eval diff=tostring(diff, "duration")
| convert timeformat="%B %d %Y %I:%M:%S %p" ctime(login)
| convert timeformat="%B %d %Y %I:%M:%S %p" ctime(logout)
| rename username as User, login as "Login Time", logout as "Logout Time", diff as "Time In Portal"
@d
now
5m
delay
none
preview
<panel>
<table>
<title>Top 10 URL's</title>
<search>
<query>index=trn5 source=*trn5* NOT Category="Maintenance"
| top 15 url
| lookup cis20.csv url as url
| rename url as URL, count as Hits, percent as Percent, category as Category, task as Task
| search NOT Category="Maintenance"
$input_time.earliest$
$input_time.latest$
5m
delay
none
preview
<panel>
<title>Training Activity</title>
<chart>
<title>Top 10 Active Users</title>
<search>
<query>index=trn5 source="*trn5/logs/system/access.log" NOT "USER03"
| lookup cis_users.csv userid as user
| top username
| rename username as User, count as Hits, percent as Percent
$input_time.earliest$
$input_time.latest$
5m
delay
pie
none
preview
... View more