<dashboard version="1.1">
  <label>ITSI SVC Statistics (Deprecated)</label>
  <row>
    <html>
      <p>
        <strong>NOTE: This version of dashboard has been deprecated. This dashboard calculates SVC usage specific to 'Workload Pricing' model only</strong>
      </p>
    </html>
  </row>
  <search>
    <query>| makeresults count=1
    </query>
    <done>
      <set token="time_tok.earliest">-60m@m</set>
      <set token="time_tok.latest">now</set>
    </done>
  </search>
  <search id="itsi_svc_usage_split_basesearch">
    <query>
      index=summary source="splunk-svc"
| timechart span=24h max(utilized_svc) as svc_total_used, max(stack_license_svc) as svc_total_entitled
| eval itsi_svc_entitled=svc_total_entitled*0.8,
  svc_total_used=round(svc_total_used, 2)
| filldown
| appendcols
    [search index=_internal host=sh* sourcetype=scheduler log_level!=DEBUG status=success
| eval search_source= if(
    `is_itsi_app`,
    "itsi",
    "not_itsi"
    )
| timechart span=24h dc(sid) BY search_source
| rename
    "itsi" AS itsi_search_count,
    "not_itsi" AS not_itsi_search_count
| eval overall_search_count=itsi_search_count+not_itsi_search_count,
itsi_search_perc=round(itsi_search_count/overall_search_count*100,0) ,
not_itsi_search_perc=round(not_itsi_search_count/overall_search_count*100,0)
| fields _time, itsi_search_perc, not_itsi_search_perc
    ]
| eval itsi_svc_used=svc_total_used*itsi_search_perc/100, itsi_svc_remain=itsi_svc_entitled-itsi_svc_used
| reverse
    </query>
    <done>
      <set token="itsi_svc_usage_split_basesearch_job_tok">$job.sid$</set>
      <set token="itsi_svc_used_tok">$result.itsi_svc_used$</set>
    </done>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <search id="itsi_svc_tag_split_basesearch">
    <query>
index=_internal sourcetype=scheduler savedsearch_name="Indicator*"
|  bin _time span=24h
| stats
    dc(sid) as activity
    by savedsearch_name, _time
|  rex field=savedsearch_name "Indicator - Shared - (?&lt;base_search_id&gt;[^\s]+) - ITSI Search"
|  rex field=savedsearch_name "Indicator - (?&lt;kpi_id&gt;[^\s]+) - ITSI Search"
| lookup service_kpi_lookup kpis.base_search_id AS base_search_id  OUTPUT service_tags.tags AS tags
| lookup service_kpi_lookup kpis._key AS kpi_id  OUTPUT service_tags.tags AS tags
|  eval tags=mvdedup(tags), tags=if(isnull(tags),"GLOBAL",tags),tag_count=mvcount(tags), activity_per_tag=activity/tag_count
|  mvexpand tags
|  stats sum(activity_per_tag) as activity by tags, _time
|  timechart span=24h first(activity) as activity by tags
    </query>
    <done>
      <set token="itsi_svc_tag_split_basesearch_job_tok">$job.sid$</set>
    </done>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <!-- DEBUG
  <row>
    <panel>
      <html>
        <h1>itsi_svc_tag_split_basesearch_job_tok=$itsi_svc_tag_split_basesearch_job_tok$</h1>
        <h1>itsi_svc_usage_split_basesearch_job_tok=$itsi_svc_usage_split_basesearch_job_tok$</h1>
      </html>
    </panel>
  </row>
  -->
  <row>
    <panel>
      <title>ITSI SVC Entitlement</title>
      <single>
        <search>
          <query>index=summary source="splunk-svc"
| stats max(stack_license_svc) AS svc_total_entitled
| eval itsi_svc_entitled=svc_total_entitled*0.8
| fields itsi_svc_entitled</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="itsi_svc_entitled_tok">$result.itsi_svc_entitled$</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <title>ITSI SVC Usage In Last 7 Days</title>
      <chart>
        <search base="itsi_svc_usage_split_basesearch">
          <query>search _time=*
| rename itsi_svc_remain AS Remain, itsi_svc_used As Used
| table _time, Remain, Used
          </query>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="charting.fieldColors">{"Remain": 0xe0e0e0, "Used":0xA83232}</option>
      </chart>
    </panel>
    <panel>
      <title>ITSI SVC Usage Breakdown by Service Tags In Last 24 Hours</title>
      <chart>
        <search base="itsi_svc_tag_split_basesearch">
          <query>
search _time=*
| reverse
| head 1
| untable _time, tag, count
| eventstats sum(count) as total_ss
| eval ss_perc=round(count/total_ss, 2), itsi_svc_used=$itsi_svc_used_tok$, svc=ss_perc*itsi_svc_used | table, tag, svc
</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>ITSI Search Breakdown By Service Tags In Last 7 Days</title>
      <chart>
        <search base="itsi_svc_tag_split_basesearch">
          <query>search _time=*
          </query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>ITSI SVC Breakdown By Service Tags In Last 7 Days</title>
      <chart>
        <search base="itsi_svc_tag_split_basesearch">
          <query>search _time=*
| reverse | untable _time, tag, count
| eventstats sum(count) as total_ss by _time
| eval ss_perc=round(count/total_ss, 2)
| table _time, tag, ss_perc
| join _time
    [loadjob $itsi_svc_usage_split_basesearch_job_tok$
     | table _time, itsi_svc_used
    ]
| eval svc=ss_perc*itsi_svc_used
| table _time, tag, svc
| timechart span=24h first(svc) as svc by tag
          </query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>