<form script="dashboard/EaFeatureFlagRedirect.js" version="1.1">
  <description>NOTE: This version of the Event Analytics Audit dashboard has been deprecated.</description>
  <label>Event Analytics Audit (Deprecated)</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="event_time_for_top_row">
      <label>Event Time Field Selector:</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

  <row>
    <panel>
      <title>Raw Event Count</title>
      <single>
        <search>
          <query>`itsi_event_management_index_with_close_events` | stats count AS events</query>
          <earliest>$event_time_for_top_row.earliest$</earliest>
          <latest>$event_time_for_top_row.latest$</latest>
          <refresh>2m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="height">190</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
    <panel>
      <title>Episodes</title>
      <single>
        <search>
          <query>`itsi_event_management_group_index` |eventstats dc(itsi_group_id) as Grouped_Incidents</query>
          <earliest>$event_time_for_top_row.earliest$</earliest>
          <latest>$event_time_for_top_row.latest$</latest>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">166</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">0</option>
        <option name="showTrendIndicator">1</option>
        <option name="useColors">1</option>
        <drilldown>
          <link target="_blank">/app/itsi/itsi_event_management</link>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>Noise Reduction</title>
      <single>
        <search>
          <query>| `itsi_event_management_noise_reduction`</query>
          <earliest>$event_time_for_top_row.earliest$</earliest>
          <latest>$event_time_for_top_row.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="height">166</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0xd93f3c","0xf58f39","0xf7bc38","0x6db7c6","0x65a637"]</option>
        <option name="rangeValues">[85,87,90,95]</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">(Raw Event Count)/(Raw Event Count + Episodes)</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <title>Episodes Linked to Tickets</title>
      <single>
        <search>
          <query>`itsi_notable_audit_index` | spath activity_type | search activity_type="Linked External T*" | eventstats dc(activity) AS Tickets</query>
          <earliest>$event_time_for_top_row.earliest$</earliest>
          <latest>$event_time_for_top_row.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>30s</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">167</option>
        <option name="numberPrecision">0</option>
        <option name="rangeValues">[10,20,30,40]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">0</option>
        <option name="useColors">1</option>
        <drilldown>
          <link target="_blank">/app/itsi/itsi_event_management</link>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>Episodes by Severity</title>
      <table>
        <search>
          <query>|`itsi_event_management_episode_by_severity`</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="Severity">
          <colorPalette type="map">{"Normal":#99D18B,"Critical":#B50101,"Low":#FFE98C,"High":#F26A35,"Medium":#FCB64E,"Information":#6DB7C6}</colorPalette>
        </format>
      </table>
    </panel>
  </row>

    <row>
    <panel>
      <title>Episodes Acknowledged</title>
      <single>
        <search>
          <query>| `itsi_event_management_get_episode_count(acknowledged)`</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>2m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="height">169</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[15,20,40]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Last 60 Minutes</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <title>Mean Time to Acknowledge Episodes</title>
      <single>
        <title>Over Last 24 hours</title>
        <search>
          <query>| `itsi_event_management_get_mean_time(acknowledged)`</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Minutes</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <title>Maximum Time to Acknowledge Episodes</title>
      <single>
        <title>Over Last 24 hours</title>
        <search>
          <query>`itsi_notable_audit_index`
| spath activity | search activity="* acknowledged *" | stats values(_time) as t2 by event_id | rename event_id as id2
| append [search `itsi_event_management_group_index` itsi_group_id=* | stats avg(itsi_first_event_time) as t1 by itsi_group_id | rename itsi_group_id as id1]
| eval match_id=coalesce(id2,id1) | stats values(*) AS * by match_id | search id1=* id2=* | fields - id1,id2
| eval t3date=(t2-t1) | stats Max(t3date) as t4 | eval "Max Duration(in minutes)" = round(t4/60,0) | fields - t4</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Minutes</option>
      </single>
    </panel>
    <panel>
      <title>Mean Time To Resolve Episodes</title>
      <single>
        <title>Over last 24 hours</title>
        <search>
          <query>| `itsi_event_management_get_mean_time(resolved)`</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="underLabel">Minutes</option>
      </single>
    </panel>
        <panel>
      <title>Episode Ownership and Status by User</title>
      <input type="dropdown" token="Search_By" searchWhenChanged="true">
        <label>Search By</label>
        <choice value="*Resolved*">Resolved</choice>
        <choice value="*Acknowledged*">Acknowledged</choice>
        <default>*Acknowledged*</default>
      </input>
      <table>
        <search>
          <query>`itsi_notable_audit_index`| spath activity | search activity=$Search_By$ | stats count by user | rename user as User, count as Count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>2m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">false</option>
      </table>
    </panel>
  </row>

  <row>
    <panel>
      <title>Top 5 Longest Time To Acknowledge Episodes</title>
      <table>
        <search>
          <query>`itsi_notable_audit_index`
| spath activity | search activity="*Acknowledge*" | stats values(_time) as t2 by event_id,user | rename event_id as id2
| append [search `itsi_event_management_group_index` itsi_group_id=* | stats avg(itsi_first_event_time) as t1 by itsi_group_id,itsi_group_severity, itsi_group_title | rename itsi_group_id as id1, itsi_group_severity as Severity, itsi_group_title as "Alert Group Title"| replace 1 with Information, 2 with Normal, 3 with Low, 4 with Medium, 5 with High, 6 with Critical]
| eval match_id=coalesce(id2,id1) | stats values(*) AS * by match_id | search id1=* id2=* | fields - id1,id2
| eval t3date=(t2-t1) | eval t1=strftime(t1, "%D-%H:%M:%S"), t2=strftime(t2, "%D-%H:%M:%S") |eval "Time to Acknowledge in Minutes"=round(t3date/60, 0)
| rename t1 as "Created", t2 as "Acknowledged"| fields - t3date
| append [search `itsi_event_management_group_index` | stats dc(itsi_group_id) by itsi_group_id,host | rename host as "Impacted Host"]
| eval match_id2=coalesce(match_id,itsi_group_id) | stats values(*) AS * by match_id2 | search match_id=* itsi_group_id=* | fields - match_id,match_id2,itsi_group_id,dc(itsi_group_id)
|rename host as Host,user as User | sort limit=5 -"Time to Acknowledge in Minutes" | table "Alert Group Title", "Created", "Acknowledged", "Impacted Host", "Severity","User" "Time to Acknowledge in Minutes"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>2m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Top 5 Longest Time To Resolve Episodes</title>
      <table>
        <search>
          <query>`itsi_notable_audit_index`
| spath activity | search activity="*Resolved*" | stats values(_time) as t2 by event_id,user | rename event_id as id2
| append [search `itsi_event_management_group_index` itsi_group_id=* | stats avg(itsi_first_event_time) as t1 by itsi_group_id,itsi_group_severity, itsi_group_title | rename itsi_group_id as id1, itsi_group_severity as Severity , itsi_group_title as "Alert Group Title"| replace 1 with Information, 2 with Normal, 3 with Low, 4 with Medium, 5 with High, 6 with Critical]
| eval match_id=coalesce(id2,id1) | stats values(*) AS * by match_id | search id1=* id2=* | fields - id1,id2
| eval t3date=(t2-t1) | eval t1=strftime(t1, "%D-%H:%M:%S"), t2=strftime(t2, "%D-%H:%M:%S") |eval "Time to Resolve in Minutes"=round(t3date/60, 0)
| rename t3date as "String Time to Resolve", t1 as "Created", t2 as "Resolved"| fields - "String Time to Resolve"| append [search `itsi_event_management_group_index` | stats dc(itsi_group_id) by itsi_group_id,host]
| eval match_id2=coalesce(match_id,itsi_group_id) | stats values(*) AS * by match_id2 | search match_id=* itsi_group_id=* | fields - match_id,match_id2,itsi_group_id,dc(itsi_group_id)
|rename host as "Impacted Host", user as User | sort limit=5 -"Time to Resolve in Minutes" | table "Alert Group Title", "Created", "Resolved", "Impacted Host", "Severity","User", "Time to Resolve in Minutes"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>2m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>

    <row>
    <panel>
      <title>Top Five Noisiest Hosts</title>
      <input type="time" token="Alerts_by_host">
        <label>Set To</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <input type="dropdown" token="span6" searchWhenChanged="true">
        <label>Span</label>
        <choice value="1m">1 minute</choice>
        <choice value="5m">5 minutes</choice>
        <choice value="10m">10 minutes</choice>
        <choice value="15m">15 minutes</choice>
        <choice value="30m">30 minutes</choice>
        <choice value="1h">1 hour</choice>
        <choice value="4">4 hours</choice>
        <choice value="12h">12 hours</choice>
        <choice value="1d">1 day</choice>
        <default>30m</default>
      </input>
      <chart>
        <search>
          <query>`itsi_event_management_group_index` | timechart span=30m count by entity_title where max in top5 | fields - OTHER, NULL</query>
          <earliest>$Alerts_by_host.earliest$</earliest>
          <latest>$Alerts_by_host.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">seriesCompare</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>Total Alerts</title>
      <input type="time" token="Alert_Times_Time_Field">
        <label>Set To</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <input type="dropdown" token="span2" searchWhenChanged="true">
        <label>Span</label>
        <choice value="1m">1 minute</choice>
        <choice value="5m">5 minutes</choice>
        <choice value="10m">10 minutes</choice>
        <choice value="15m">15 minutes</choice>
        <choice value="30m">30 minutes</choice>
        <choice value="1h">1 hour</choice>
        <choice value="4">4 hours</choice>
        <choice value="12h">12 hours</choice>
        <choice value="1d">1 day</choice>
        <default>30m</default>
      </input>
      <chart>
        <search>
          <query>`itsi_event_management_group_index` | table _time | timechart span=$span2$ count by events | rename NULL as "Total Alerts"</query>
          <earliest>$Alert_Times_Time_Field.earliest$</earliest>
          <latest>$Alert_Times_Time_Field.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Number of Alerts</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <link>
            <![CDATA[
          /app/search/test2?form.test2token=$span2$
          ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>

    <row>
    <panel>
      <title>Service Health Scores Correlated to Critical/High Episodes</title>
      <input type="time" token="Service_Health_Alerts_Time_Picker">
        <label>Set To</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <input type="dropdown" token="span4" searchWhenChanged="true">
        <label>Span</label>
        <choice value="1m">1 minute</choice>
        <choice value="5m">5 minutes</choice>
        <choice value="10m">10 minutes</choice>
        <choice value="15m">15 minutes</choice>
        <choice value="30m">30 minutes</choice>
        <choice value="1h">1 hour</choice>
        <choice value="4">4 hours</choice>
        <choice value="12h">12 hours</choice>
        <choice value="1d">1 day</choice>
        <default>30m</default>
      </input>
      <chart>
        <search>
          <query>`get_itsi_summary_index`
|lookup service_kpi_lookup _key AS serviceid OUTPUT title AS service_title
|timechart span=$span4$ avg(severity_value) by service_title where min in bottom7
|append [search `itsi_event_management_group_index` itsi_group_severity=5 OR itsi_group_severity=6 | eval bad="5"+"6" |timechart span=$span4$ count BY bad | rename 56 as "ALERTS"] | fields - NULL</query>
          <earliest>$Service_Health_Alerts_Time_Picker.earliest$</earliest>
          <latest>$Service_Health_Alerts_Time_Picker.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">seriesCompare</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <link target="_blank">/app/itsi/homeview</link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>