<form version="1.1">
  <label>Traffic Dashboard</label>
  <fieldset autoRun="true" submitButton="true">
    <input type="time" searchWhenChanged="true" token="time_token">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="device">
      <label>Device</label>
      <default>*</default>
      <prefix>log.devname="</prefix>
      <suffix>"</suffix>
      <choice value="*">ANY</choice>
      <search>
        <query>| `_ftnt_dropdown(log.traffic, log.devname)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
    <input type="dropdown" token="vdom" searchWhenChanged="true">
      <label>Virtual Domain</label>
      <prefix>log.vd="</prefix>
      <suffix>"</suffix>
      <choice value="*">ANY</choice>
      <search>
        <query>| `_ftnt_dropdown(log.traffic, log.vd)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
      <default>*</default>
    </input>
    <input type="text" token="srcip">
      <label>Source IP</label>
      <prefix>log.srcip="</prefix>
      <suffix>"</suffix>
      <default>*</default>
    </input>
    <input type="text" token="dstip">
      <label>Destination IP</label>
      <prefix>log.dstip="</prefix>
      <suffix>"</suffix>
      <default>*</default>
    </input>
    <input type="text" token="user">
      <label>User</label>
      <default>*</default>
      <prefix>(log.suser="</prefix>
      <suffix>" OR log.user="")</suffix>
    </input>
    <input type="dropdown" token="app" searchWhenChanged="true">
      <label>Application</label>
      <prefix>(log.traffic.app="</prefix>
      <suffix>" OR log.traffic.app="")</suffix>
      <search>
        <query>| `_ftnt_dropdown(log.traffic, log.traffic.app)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
      <choice value="*">ANY</choice>
      <default>*</default>
    </input>
    <input type="dropdown" token="srcintf">
      <label>Source Interface</label>
      <choice value="*">ANY</choice>
      <default>*</default>
      <prefix>log.traffic.srcintf="</prefix>
      <suffix>"</suffix>
      <search>
        <query>| `_ftnt_dropdown(log.traffic, log.traffic.srcintf)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
    <input type="dropdown" token="dstintf">
      <label>Destination Interface</label>
      <choice value="*">ANY</choice>
      <default>*</default>
      <prefix>log.traffic.dstintf="</prefix>
      <suffix>"</suffix>
      <search>
        <query>| `_ftnt_dropdown(log.traffic, log.traffic.dstintf)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Sessions Over Time</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count latest(log.traffic.sessionid) as sessionid FROM datamodel=ftnt_fos where nodename="log.traffic"  log.srcip="*" log.dstip="*" log.vd="*" log.vendor_action="*" log.devname="*" (log.suser="*" OR log.user="") (log.traffic.app="*" OR log.traffic.app="")   log.traffic.srcintf="*" log.traffic.dstintf="*" GROUPBY _time , log.traffic.action, log.traffic.sessionid | timechart dc("sessionid") by log.traffic.action</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel>
      <title>Traffic Over Time</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true sum(log.sentbyte) AS sumSent sum(log.rcvdbyte) AS sumReceived from datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$ $vdom$ $device$ $user$ $app$   $srcintf$ $dstintf$   groupby _time | eval msumSent = (sumSent/(1024*1024))  | eval msumReceived = (sumReceived/(1024*1024)) | timechart values("msumReceived") AS "MBytes Received" values("msumSent") AS "MBytes Sent"</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Top Source IP</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$  $user$ $app$ $vdom$ $device$   $srcintf$ $dstintf$  groupby log.srcip | sort -count | head 20</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.map.center">(0,0)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.tileLayer.maxZoom">7</option>
        <option name="mapping.tileLayer.minZoom">0</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_traffic` srcip="$click.value$" earliest=$time_token.earliest$&latest=$time_token.latest$
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Top Destination IP</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$ $user$ $app$ $vdom$ $device$   $srcintf$ $dstintf$ groupby log.dstip | sort -count | head 20</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_traffic` dstip="$click.value$" earliest=$time_token.earliest$&latest=$time_token.latest$
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Traffic by Device</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true sum(log.bytes) as MBytes_transferred from datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$ $user$ $app$ $vdom$ $device$    $srcintf$ $dstintf$ groupby log.devname   | eval MBytes_transferred = (MBytes_transferred/(1024*1024)) | sort -MBytes_transferred | head 10</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_traffic` devname="$click.value$" earliest=$time_token.earliest$&latest=$time_token.latest$
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Traffic by User</title>
      <chart>
        <search>
          <query>|tstats summariesonly=true sum(log.bytes) as MBytes_transferred from datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$  $user$ $app$ $vdom$ $device$   $srcintf$ $dstintf$ groupby log.user  | eval MBytes_transferred = (MBytes_transferred/(1024*1024)) | sort -MBytes_transferred | head 10</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">false</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <option name="wrap">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.axisTitleX.text">User</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_traffic` user="$click.value$" earliest=$time_token.earliest$&latest=$time_token.latest$
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Traffic by Application</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true sum(log.bytes) as MBytes_transferred from datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$ $user$ $app$ $vdom$ $device$    $srcintf$ $dstintf$ groupby log.traffic.app   | eval MBytes_transferred = (MBytes_transferred/(1024*1024)) | sort -MBytes_transferred | head 10</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_traffic` app="$click.value$" earliest=$time_token.earliest$&latest=$time_token.latest$
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Traffic  by  Interface</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true sum(log.bytes) as MBytes_transferred from datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$  $user$ $app$ $vdom$ $device$   $srcintf$ $dstintf$  groupby log.traffic.srcintf   | eval MBytes_transferred = (MBytes_transferred/(1024*1024)) | sort -MBytes_transferred | head 10</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_traffic` srcintf="$click.value$" earliest=$time_token.earliest$&latest=$time_token.latest$
              ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>
