
<dashboard version="2" theme="light">
    <label>ITSI SVC Statistics</label>
    <description>This dashboard calculates SVC usage specific to &#39;Workload Pricing&#39; model only</description>
    <definition><![CDATA[
{
	"visualizations": {
		"viz_lueLUDRq": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_CPEO12Bf"
			},
			"title": "ITSI SVC Entitlement"
		},
		"viz_vN1wE0gq": {
			"type": "splunk.column",
			"options": {
				"yAxisAbbreviation": "off",
				"y2AxisAbbreviation": "off",
				"showRoundedY2AxisLabels": false,
				"legendTruncation": "ellipsisMiddle",
				"showY2MajorGridLines": true,
				"stackMode": "stacked",
				"seriesColorsByField": {
					"Used": "#a83232",
					"Remain": "#e0e0e0"
				}
			},
			"dataSources": {
				"primary": "ds_kllf6r23"
			},
			"title": "ITSI SVC Usage In Last 7 Days",
			"showProgressBar": true
		},
		"viz_I4afjE3i": {
			"type": "splunk.pie",
			"options": {
				"collapseThreshold": 0.01,
				"collapseLabel": "Other"
			},
			"dataSources": {
				"primary": "ds_X20b7k2f"
			},
			"title": "ITSI SVC Usage Breakdown by Service Tags In Last 24 Hours",
			"showProgressBar": true
		},
		"viz_NeT2B7JH": {
			"type": "splunk.column",
			"options": {
				"yAxisAbbreviation": "auto",
				"y2AxisAbbreviation": "auto",
				"showRoundedY2AxisLabels": false,
				"legendTruncation": "ellipsisMiddle",
				"showY2MajorGridLines": true,
				"xAxisLabelRotation": 0,
				"xAxisTitleVisibility": "show",
				"yAxisTitleVisibility": "show",
				"y2AxisTitleVisibility": "show",
				"yAxisScale": "linear",
				"showOverlayY2Axis": 0,
				"y2AxisScale": "inherit",
				"dataValuesDisplay": "off",
				"stackMode": "stacked100",
				"showSplitSeries": 0,
				"showIndependentYRanges": 0,
				"legendDisplay": "right"
			},
			"dataSources": {
				"primary": "ds_GHm5TAY5"
			},
			"title": "ITSI Search Breakdown By Service Tags In Last 7 Days",
			"showProgressBar": true
		},
		"viz_ccJrXxWt": {
			"type": "splunk.column",
			"options": {
				"yAxisAbbreviation": "auto",
				"y2AxisAbbreviation": "auto",
				"showRoundedY2AxisLabels": false,
				"legendTruncation": "ellipsisMiddle",
				"showY2MajorGridLines": true,
				"xAxisLabelRotation": 0,
				"xAxisTitleVisibility": "show",
				"yAxisTitleVisibility": "show",
				"y2AxisTitleVisibility": "show",
				"yAxisScale": "linear",
				"showOverlayY2Axis": 0,
				"y2AxisScale": "inherit",
				"dataValuesDisplay": "off",
				"stackMode": "stacked100",
				"showSplitSeries": 0,
				"showIndependentYRanges": 0,
				"legendDisplay": "right"
			},
			"dataSources": {
				"primary": "ds_9Pfseqrt"
			},
			"title": "ITSI SVC Breakdown By Service Tags In Last 7 Days",
			"showProgressBar": true
		},
		"viz_zJdik26s": {
			"type": "splunk.markdown",
			"options": {
				"markdown": "\n**NOTE:** You're now using the latest ITSI SVC Statistics Dashboard experience. The old version is deprecated and no longer receiving updates. [Access the old dashboard](/app/itsi/itsi_svc_statistics_deprecated)"
			}
		}
	},
	"dataSources": {
		"ds_kzYyg6OZ": {
			"type": "ds.search",
			"options": {
				"query": "| makeresults count=1\n    "
			}
		},
		"ds_itsi_svc_usage_split_basesearch": {
			"type": "ds.search",
			"options": {
				"query": "\n      index=summary source=\"splunk-svc\"\n| timechart span=24h max(utilized_svc) as svc_total_used, max(stack_license_svc) as svc_total_entitled\n| eval itsi_svc_entitled=svc_total_entitled*0.8,\n  svc_total_used=round(svc_total_used, 2)\n| filldown\n| appendcols\n    [search index=_internal host=sh* sourcetype=scheduler log_level!=DEBUG status=success\n| eval search_source= if(\n    `is_itsi_app`,\n    \"itsi\",\n    \"not_itsi\"\n    )\n| timechart span=24h dc(sid) BY search_source\n| rename\n    \"itsi\" AS itsi_search_count,\n    \"not_itsi\" AS not_itsi_search_count\n| eval overall_search_count=itsi_search_count+not_itsi_search_count,\nitsi_search_perc=round(itsi_search_count/overall_search_count*100,0) ,\nnot_itsi_search_perc=round(not_itsi_search_count/overall_search_count*100,0)\n| fields _time, itsi_search_perc, not_itsi_search_perc\n    ]\n| eval itsi_svc_used=svc_total_used*itsi_search_perc/100, itsi_svc_remain=itsi_svc_entitled-itsi_svc_used\n| reverse\n    ",
				"queryParameters": {
					"earliest": "-7d@h",
					"latest": "now"
				},
				"enableSmartSources": true
			},
			"name": "ds_itsi_svc_usage_split_basesearch"
		},
		"ds_itsi_svc_tag_split_basesearch": {
			"type": "ds.search",
			"options": {
				"query": "\nindex=_internal sourcetype=scheduler savedsearch_name=\"Indicator*\"\n|  bin _time span=24h\n| stats\n    dc(sid) as activity\n    by savedsearch_name, _time\n|  rex field=savedsearch_name \"Indicator - Shared - (?<base_search_id>[^\\s]+) - ITSI Search\"\n|  rex field=savedsearch_name \"Indicator - (?<kpi_id>[^\\s]+) - ITSI Search\"\n| lookup service_kpi_lookup kpis.base_search_id AS base_search_id  OUTPUT service_tags.tags AS tags\n| lookup service_kpi_lookup kpis._key AS kpi_id  OUTPUT service_tags.tags AS tags\n|  eval tags=mvdedup(tags), tags=if(isnull(tags),\"GLOBAL\",tags),tag_count=mvcount(tags), activity_per_tag=activity/tag_count\n|  mvexpand tags\n|  stats sum(activity_per_tag) as activity by tags, _time\n|  timechart span=24h first(activity) as activity by tags\n    ",
				"queryParameters": {
					"earliest": "-7d@h",
					"latest": "now"
				},
				"enableSmartSources": true
			},
			"name": "ds_itsi_svc_tag_split_basesearch"
		},
		"ds_CPEO12Bf": {
			"type": "ds.search",
			"options": {
				"query": "index=summary source=\"splunk-svc\"\n| stats max(stack_license_svc) AS svc_total_entitled\n| eval itsi_svc_entitled=svc_total_entitled*0.8\n| fields itsi_svc_entitled",
				"queryParameters": {
					"earliest": "-30d@d",
					"latest": "now"
				}
			},
			"name": "ITSI SVC Entitlement - Single value search"
		},
		"ds_kllf6r23": {
			"type": "ds.chain",
			"options": {
				"query": "search _time=*\n| rename itsi_svc_remain AS Remain, itsi_svc_used As Used\n| table _time, Remain, Used\n          ",
				"extend": "ds_itsi_svc_usage_split_basesearch"
			},
			"name": "ITSI SVC Usage In Last 7 Days - Column chart search"
		},
		"ds_X20b7k2f": {
			"type": "ds.chain",
			"options": {
				"query": "\nsearch _time=*\n| reverse\n| head 1\n| untable _time, tag, count\n| eventstats sum(count) as total_ss\n| eval ss_perc=round(count/total_ss, 2), itsi_svc_used=$ds_itsi_svc_usage_split_basesearch:result.itsi_svc_used$, svc=ss_perc*itsi_svc_used | table, tag, svc\n",
				"extend": "ds_itsi_svc_tag_split_basesearch"
			},
			"name": "ITSI SVC Usage Breakdown by Service Tags In Last 24 Hours - Pie chart search"
		},
		"ds_GHm5TAY5": {
			"type": "ds.chain",
			"options": {
				"query": "search _time=*\n          ",
				"extend": "ds_itsi_svc_tag_split_basesearch"
			},
			"name": "ITSI Search Breakdown By Service Tags In Last 7 Days - Column chart search"
		},
		"ds_9Pfseqrt": {
			"type": "ds.chain",
			"options": {
				"query": "search _time=*\n| reverse | untable _time, tag, count\n| eventstats sum(count) as total_ss by _time\n| eval ss_perc=round(count/total_ss, 2)\n| table _time, tag, ss_perc\n| join _time\n    [loadjob $ds_itsi_svc_usage_split_basesearch:job.sid$\n     | table _time, itsi_svc_used\n    ]\n| eval svc=ss_perc*itsi_svc_used\n| table _time, tag, svc\n| timechart span=24h first(svc) as svc by tag\n          ",
				"extend": "ds_itsi_svc_tag_split_basesearch"
			},
			"name": "ITSI SVC Breakdown By Service Tags In Last 7 Days - Column chart search"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {}
				}
			}
		}
	},
	"inputs": {
		"itsi_svc_used_tok": {
			"options": {
				"token": "itsi_svc_used_tok",
				"defaultValue": "$ds_itsi_svc_usage_split_basesearch.results.itsi_svc_used"
			}
		}
	},
	"layout": {
		"type": "grid",
		"options": {
			"height": 500,
			"width": 1440
		},
		"structure": [
			{
				"item": "viz_zJdik26s",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 1440,
					"h": 64
				}
			},
			{
				"item": "viz_lueLUDRq",
				"type": "block",
				"position": {
					"x": 0,
					"y": 64,
					"w": 480,
					"h": 288
				}
			},
			{
				"item": "viz_NeT2B7JH",
				"type": "block",
				"position": {
					"x": 0,
					"y": 352,
					"w": 720,
					"h": 306
				}
			},
			{
				"item": "viz_vN1wE0gq",
				"type": "block",
				"position": {
					"x": 480,
					"y": 64,
					"w": 480,
					"h": 288
				}
			},
			{
				"item": "viz_ccJrXxWt",
				"type": "block",
				"position": {
					"x": 720,
					"y": 352,
					"w": 720,
					"h": 306
				}
			},
			{
				"item": "viz_I4afjE3i",
				"type": "block",
				"position": {
					"x": 960,
					"y": 64,
					"w": 480,
					"h": 288
				}
			}
		],
		"globalInputs": []
	},
	"description": "This dashboard calculates SVC usage specific to 'Workload Pricing' model only",
	"title": "ITSI SVC Statistics"
}
    ]]></definition>
    <meta type="hiddenElements"><![CDATA[
{
	"hideEdit": false,
	"hideOpenInSearch": false,
	"hideExport": false
}
    ]]></meta>
</dashboard>