<form version="1.1">
  <label>VPN Dashboard</label>
  <description></description>
  <fieldset autoRun="true" submitButton="true">
    <input type="time" searchWhenChanged="true" token="time_token">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="devname">
      <label>Device</label>
      <choice value="*">ANY</choice>
      <default>*</default>
      <prefix>log.devname="</prefix>
      <suffix>"</suffix>
      <search>
        <query>|`_ftnt_dropdown(log.system_event.vpn, log.devname)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
    <input type="dropdown" token="vdom">
      <label>Virtual Domain</label>
      <prefix>log.vd="</prefix>
      <suffix>"</suffix>
      <choice value="*">ANY</choice>
      <search>
        <query>| `_ftnt_dropdown(log.system_event.vpn, log.vd)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="tunneltype">
      <label>Tunnel Type</label>
      <choice value="*">ANY</choice>
      <default>*</default>
      <prefix>log.system_event.vpn.tunneltype="</prefix>
      <suffix>"</suffix>
      <search>
        <query>|`_ftnt_dropdown(log.system_event.vpn, log.system_event.vpn.tunneltype)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
    <input type="dropdown" token="user">
      <label>VPN user</label>
      <choice value="*">ANY</choice>
      <default>*</default>
      <prefix>log.user="</prefix>
      <suffix>"</suffix>
      <search>
        <query>|`_ftnt_dropdown(log.system_event.vpn, log.user)`</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <fieldForLabel>field_with_count</fieldForLabel>
      <fieldForValue>field</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Throughput by VPN Tunnel</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true last(log.system_event.vpn.tunnelname), last(log.sentbyte) AS Sent, last(log.rcvdbyte) AS Received FROM datamodel="ftnt_fos" WHERE nodename="log.system_event.vpn"   log.sentbyte!=0 log.rcvdbyte!=0  $devname$ $vdom$ $tunneltype$ $user$  groupby log.system_event.vpn.tunnelname  | rename log.system_event.vpn.tunnelname AS Tunnel_Name,   | dedup Tunnel_Name |eval Received_MB = (Received/(1024*1024)) | eval Sent_MB = (Sent/(1024*1024))| eval Transferred = Received_MB + Sent_MB | sort -Transferred| Fields Tunnel_Name, Received_MB, Sent_MB |  head 20</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>[]</fields>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_vpn` tunnelname="$click.value$" &earliest=$time_token.earliest$&latest=$time_token.latest$]]>
          </link>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Connections By Time</title>
      <chart>
        <search>
          <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" WHERE nodename="log.system_event.vpn"  $devname$ $vdom$ $tunneltype$ $user$  (log.vendor_action="tunnel-up" OR log.vendor_action="phase2-up") GROUPBY _time | timechart values(count)</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>[]</fields>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.axisTitleY.text">Connections</option>
        <drilldown>
          <link>
            <![CDATA[
                /app/SplunkAppForFortinet/search?q=`fortigate_vpn` (vendor_action="tunnel-up" OR vendor_action="phase2-up")&earliest=$time_token.earliest$&latest=$time_token.latest$]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Latest Events</title>
      <table>
        <search>
          <query>| tstats summariesonly=true  max(_time) AS NTime, last(log.system_event.vpn.tunnelname) AS Tunnel_Name, last(log.sentbyte) AS Sent, last(log.rcvdbyte) AS Received, last(log.system_event.vpn.tunneltype) AS Tunnel_Type, last(log.user) AS User, last(log.system_event.vpn.group) AS User_Group, last(log.system_event.vpn.duration) AS Duration_Sec FROM datamodel="ftnt_fos" WHERE nodename="log.system_event.vpn"   log.sentbyte!=0 log.rcvdbyte!=0 $devname$ $vdom$ $tunneltype$ $user$ groupby _time log.system_event.vpn.tunnelname | sort -_time | eval Received_MB = (Received/(1024*1024))| eval Sent_MB = (Sent/(1024*1024))   |sort -_time| convert ctime(NTime) as Time |  table Time, Tunnel_Name, Tunnel_Type, User, User_Group, Sent_MB, Received_MB, Duration_Sec</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <option name="drilldown">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>
