You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
371 lines
15 KiB
371 lines
15 KiB
<form theme="dark" version="1.1">
|
|
<init>
|
|
<set token="form.user_act_time_tok.earliest">-24h</set>
|
|
<set token="form.user_act_time_tok.latest">now</set>
|
|
<set token="form.item_type_tok">*</set>
|
|
<set token="item_type_tok">*</set>
|
|
</init>
|
|
<label>M365 Sharepoint Overview</label>
|
|
<fieldset submitButton="false" autoRun="true">
|
|
<input type="time" token="time_tok" searchWhenChanged="true">
|
|
<label>Time Picker</label>
|
|
<default>
|
|
<earliest>-24h@h</earliest>
|
|
<latest>now</latest>
|
|
</default>
|
|
<change>
|
|
<set token="form.user_act_time_tok.earliest">$time_tok.earliest$</set>
|
|
<set token="form.user_act_time_tok.latest">$time_tok.latest$</set>
|
|
</change>
|
|
</input>
|
|
<input type="dropdown" token="site_tok" searchWhenChanged="true">
|
|
<label>Sites</label>
|
|
<fieldForLabel>ObjectSite</fieldForLabel>
|
|
<fieldForValue>ObjectSite</fieldForValue>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=Sharepoint
|
|
| rex field=ObjectId "\\/sites\\/(?<ObjectSite>[^\\/]+)"
|
|
| stats count by ObjectSite</query>
|
|
<earliest>-24h@h</earliest>
|
|
<latest>now</latest>
|
|
</search>
|
|
<choice value="*">All</choice>
|
|
<default>*</default>
|
|
<initialValue>*</initialValue>
|
|
</input>
|
|
</fieldset>
|
|
<row>
|
|
<panel>
|
|
<single>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype=o365:management:activity Workload=SharePoint Operation=PageViewed
|
|
| stats dc(SiteName)</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="drilldown">none</option>
|
|
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
<option name="underLabel">Sites Viewed in Sharepoint</option>
|
|
</single>
|
|
<single>
|
|
<search>
|
|
<query>index="*" sourcetype="o365:management:activity" Workload=Sharepoint ItemType=File
|
|
| search SiteName="$site_tok$"
|
|
| dedup object_id
|
|
| stats count(object_id)</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="drilldown">none</option>
|
|
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
<option name="underLabel">Active Files</option>
|
|
</single>
|
|
<single>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=Sharepoint ItemType=Page
|
|
| search SiteName="$site_tok$"
|
|
| dedup object_id
|
|
| stats count(object_id)</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="drilldown">none</option>
|
|
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
<option name="underLabel">Active Pages</option>
|
|
</single>
|
|
<single>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:graph:api" source IN ("getSharePointSiteUsageDetail(period='*')", "SharePointSiteUsageDetail")
|
|
| rex field="Site URL" "\\/sites\\/(?<ObjectSite>[^\\/]+)"
|
|
| search ObjectSite="$site_tok$"
|
|
| stats count by "Storage Allocated (Byte)" "Storage Used (Byte)" ObjectSite, _time
|
|
| rename "Storage Allocated (Byte)" as storage_allocated "Storage Used (Byte)" as storage_used ObjectSite as site_url
|
|
| eval storage_remaining = storage_allocated - storage_used
|
|
| eval %_storage_remaining = (storage_remaining/storage_allocated)*100
|
|
| chart avg(%_storage_remaining) by _time</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="drilldown">none</option>
|
|
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
<option name="showSparkline">1</option>
|
|
<option name="trendDisplayMode">percent</option>
|
|
<option name="trendInterval">-7d</option>
|
|
<option name="underLabel">% Storage remaining</option>
|
|
<option name="unit">%</option>
|
|
</single>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<single>
|
|
<title>Active Users</title>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype=o365:management:activity Workload=SharePoint
|
|
| rex field=ObjectId "\\/sites\\/(?<ObjectSite>[^\\/]+)"
|
|
| search ObjectSite="$site_tok$"
|
|
| timechart span=1d dc(UserId)</query>
|
|
<earliest>-7d@h</earliest>
|
|
<latest>now</latest>
|
|
<sampleRatio>1</sampleRatio>
|
|
</search>
|
|
<option name="colorBy">value</option>
|
|
<option name="colorMode">block</option>
|
|
<option name="drilldown">none</option>
|
|
<option name="numberPrecision">0</option>
|
|
<option name="rangeColors">["0x0070BD","0x0070BD"]</option>
|
|
<option name="rangeValues">[0]</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
<option name="showSparkline">1</option>
|
|
<option name="showTrendIndicator">1</option>
|
|
<option name="trellis.enabled">0</option>
|
|
<option name="trellis.scales.shared">1</option>
|
|
<option name="trellis.size">medium</option>
|
|
<option name="trendColorInterpretation">standard</option>
|
|
<option name="trendDisplayMode">absolute</option>
|
|
<option name="trendInterval">-7d</option>
|
|
<option name="underLabel">Compared to last week</option>
|
|
<option name="unitPosition">after</option>
|
|
<option name="useColors">1</option>
|
|
<option name="useThousandSeparators">1</option>
|
|
</single>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<chart>
|
|
<title>Top Sites in Sharepoint</title>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=SharePoint Operation=PageViewed
|
|
| top SiteName limit=5</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="charting.chart">bar</option>
|
|
<option name="charting.drilldown">none</option>
|
|
<option name="charting.legend.placement">none</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
</chart>
|
|
</panel>
|
|
<panel>
|
|
<chart>
|
|
<title>Top File Accessed</title>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=SharePoint Operation=FileAccessed
|
|
| search SiteName="$site_tok$"
|
|
| top SourceFileName limit=5</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="charting.chart">bar</option>
|
|
<option name="charting.drilldown">none</option>
|
|
<option name="charting.legend.placement">none</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
</chart>
|
|
</panel>
|
|
<panel>
|
|
<chart>
|
|
<title>Top Pages Viewed</title>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=Sharepoint ItemType=Page Operation=PageViewed
|
|
| search SiteName="$site_tok$"
|
|
| rex field=ObjectId "\\/(?<ObjectPage>[^\\/.]+).aspx$"
|
|
| eval Page=if(isnull(ObjectPage),ObjectSite,ObjectPage)
|
|
| search Page=*
|
|
|top Page limit=5</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="charting.chart">bar</option>
|
|
<option name="charting.drilldown">none</option>
|
|
<option name="charting.legend.placement">none</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
</chart>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<title>Page Views Timechart</title>
|
|
<chart>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=Sharepoint ItemType=Page Operation=PageViewed
|
|
| search SiteName="$site_tok$"
|
|
| rex field=ObjectId "\\/(?<ObjectPage>[^\\/.]+).aspx$"
|
|
| eval Page=if(isnull(ObjectPage),ObjectSite,ObjectPage)
|
|
| search Page=*
|
|
| timechart count by Page useother=f</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="charting.chart">line</option>
|
|
<option name="charting.drilldown">all</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
</chart>
|
|
</panel>
|
|
<panel>
|
|
<map>
|
|
<title>User Activity - Map</title>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=SharePoint | search SiteName="$site_tok$"
|
|
| iplocation src | geostats dc(UserId) AS Users</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<option name="drilldown">none</option>
|
|
<option name="height">295</option>
|
|
<option name="mapping.type">marker</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
</map>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<title>Activities</title>
|
|
<input type="dropdown" token="item_type_tok" searchWhenChanged="true">
|
|
<label>Activity Type</label>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=Sharepoint ItemType="Page" OR ItemType="File" OR ItemType="Web" | stats count by ItemType</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<choice value="*">All</choice>
|
|
<fieldForLabel>ItemType</fieldForLabel>
|
|
<fieldForValue>ItemType</fieldForValue>
|
|
<default>*</default>
|
|
<initialValue>*</initialValue>
|
|
</input>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<title>Activities Timechart</title>
|
|
<chart>
|
|
<title>Select or Zoom in Chart to Drilldown</title>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=Sharepoint
|
|
SiteName="$site_tok$" ItemType=$item_type_tok$
|
|
| timechart count by Operation</query>
|
|
<earliest>$time_tok.earliest$</earliest>
|
|
<latest>$time_tok.latest$</latest>
|
|
</search>
|
|
<selection>
|
|
<set token="form.user_act_time_tok.earliest">$start$</set>
|
|
<set token="form.user_act_time_tok.latest">$end$</set>
|
|
</selection>
|
|
<option name="charting.chart">line</option>
|
|
<option name="charting.drilldown">all</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
<drilldown>
|
|
<set token="form.user_act_time_tok.earliest">$earliest$</set>
|
|
<set token="form.user_act_time_tok.latest">$latest$</set>
|
|
<set token="form.filter_value">$click.name2$</set>
|
|
<set token="form.filter_field">Operation</set>
|
|
</drilldown>
|
|
</chart>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<title>User Activity by Operations</title>
|
|
<input type="time" token="user_act_time_tok" searchWhenChanged="true">
|
|
<label>Time Picker For User Activities</label>
|
|
<default>
|
|
<earliest>-24h</earliest>
|
|
<latest>now</latest>
|
|
</default>
|
|
</input>
|
|
<input type="dropdown" token="filter_field" searchWhenChanged="true">
|
|
<label>Filter Field</label>
|
|
<choice value="">None</choice>
|
|
<choice value="user">User</choice>
|
|
<choice value="action_target">Action Target</choice>
|
|
<choice value="Operation">Operation</choice>
|
|
<fieldForLabel>makeresults</fieldForLabel>
|
|
<fieldForValue>makeresults</fieldForValue>
|
|
<search>
|
|
<query>|makeresults</query>
|
|
<earliest>$user_act_time_tok.earliest$</earliest>
|
|
<latest>$user_act_time_tok.latest$</latest>
|
|
</search>
|
|
<change>
|
|
<condition label="None">
|
|
<set token="form.filter_value"></set>
|
|
<set token="filter_value"></set>
|
|
</condition>
|
|
<condition value="_time">
|
|
<set token="form.user_act_time_tok.earliest">$form.filter_value$</set>
|
|
<set token="form.user_act_time_tok.latest">now</set>
|
|
<set token="form.filter_value"></set>
|
|
<set token="form.filter_field"></set>
|
|
</condition>
|
|
</change>
|
|
<default></default>
|
|
</input>
|
|
<input type="text" token="filter_value" searchWhenChanged="true">
|
|
<label>Filter Value</label>
|
|
<default></default>
|
|
<prefix>="</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<input type="text" token="display_limit_tok" searchWhenChanged="true">
|
|
<label>Display Limit</label>
|
|
<default>50</default>
|
|
<initialValue>50</initialValue>
|
|
</input>
|
|
<viz type="sankey_diagram_app.sankey_diagram">
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=Sharepoint ItemType=$item_type_tok$
|
|
| search SiteName="$site_tok$"
|
|
| rex field=ObjectId "\\/(?<ObjectPage>[^\\/.]+).aspx$"
|
|
| eval Page=if(isnull(ObjectPage),SiteName,ObjectPage)
|
|
| eval action_target=case(ItemType="Web",TargetUserOrGroupName,ItemType="File",SourceFileName,ItemType="Page",Page,isnotnull(ObjectId),ObjectId)
|
|
| search $filter_field$$filter_value$
|
|
| stats count by UserId Operation
|
|
| sort -count
|
|
| head $display_limit_tok$
|
|
| rename UserId as source, Operation as target</query>
|
|
<earliest>$user_act_time_tok.earliest$</earliest>
|
|
<latest>$user_act_time_tok.latest$</latest>
|
|
</search>
|
|
<option name="drilldown">none</option>
|
|
<option name="height">578</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
</viz>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<table>
|
|
<title>Select User, Operation or Action Target to Drilldown</title>
|
|
<search>
|
|
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=Sharepoint ItemType=$item_type_tok$
|
|
| search SiteName="$site_tok$"
|
|
| rex field=ObjectId "\\/(?<ObjectPage>[^\\/.]+).aspx$"
|
|
| eval Page=if(isnull(ObjectPage),SiteName,ObjectPage)
|
|
| eval action_target=case(ItemType="Web",TargetUserOrGroupName,ItemType="File",SourceFileName,ItemType="Page",Page,isnotnull(ObjectId),ObjectId)
|
|
| search $filter_field$$filter_value$
|
|
| table _time UserId Operation action_target
|
|
| sort -_time</query>
|
|
<earliest>$user_act_time_tok.earliest$</earliest>
|
|
<latest>$user_act_time_tok.latest$</latest>
|
|
</search>
|
|
<option name="refresh.display">progressbar</option>
|
|
<drilldown>
|
|
<set token="form.filter_field">$click.name2$</set>
|
|
<set token="form.filter_value">$click.value2$</set>
|
|
</drilldown>
|
|
</table>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<html>
|
|
<img src="/static/app/DA-ITSI-CP-m365/SharePoint.png" width="100"/>
|
|
</html>
|
|
</panel>
|
|
</row>
|
|
</form> |