This dashboard calculates SVC usage specific to 'Workload Pricing' model only
[^\\s]+) - ITSI Search\"\n| rex field=savedsearch_name \"Indicator - (?[^\\s]+) - ITSI Search\"\n| lookup service_kpi_lookup kpis.base_search_id AS base_search_id OUTPUT service_tags.tags AS tags\n| lookup service_kpi_lookup kpis._key AS kpi_id OUTPUT service_tags.tags AS tags\n| eval tags=mvdedup(tags), tags=if(isnull(tags),\"GLOBAL\",tags),tag_count=mvcount(tags), activity_per_tag=activity/tag_count\n| mvexpand tags\n| stats sum(activity_per_tag) as activity by tags, _time\n| timechart span=24h first(activity) as activity by tags\n ",
"queryParameters": {
"earliest": "-7d@h",
"latest": "now"
},
"enableSmartSources": true
},
"name": "ds_itsi_svc_tag_split_basesearch"
},
"ds_CPEO12Bf": {
"type": "ds.search",
"options": {
"query": "index=summary source=\"splunk-svc\"\n| stats max(stack_license_svc) AS svc_total_entitled\n| eval itsi_svc_entitled=svc_total_entitled*0.8\n| fields itsi_svc_entitled",
"queryParameters": {
"earliest": "-30d@d",
"latest": "now"
}
},
"name": "ITSI SVC Entitlement - Single value search"
},
"ds_kllf6r23": {
"type": "ds.chain",
"options": {
"query": "search _time=*\n| rename itsi_svc_remain AS Remain, itsi_svc_used As Used\n| table _time, Remain, Used\n ",
"extend": "ds_itsi_svc_usage_split_basesearch"
},
"name": "ITSI SVC Usage In Last 7 Days - Column chart search"
},
"ds_X20b7k2f": {
"type": "ds.chain",
"options": {
"query": "\nsearch _time=*\n| reverse\n| head 1\n| untable _time, tag, count\n| eventstats sum(count) as total_ss\n| eval ss_perc=round(count/total_ss, 2), itsi_svc_used=$ds_itsi_svc_usage_split_basesearch:result.itsi_svc_used$, svc=ss_perc*itsi_svc_used | table, tag, svc\n",
"extend": "ds_itsi_svc_tag_split_basesearch"
},
"name": "ITSI SVC Usage Breakdown by Service Tags In Last 24 Hours - Pie chart search"
},
"ds_GHm5TAY5": {
"type": "ds.chain",
"options": {
"query": "search _time=*\n ",
"extend": "ds_itsi_svc_tag_split_basesearch"
},
"name": "ITSI Search Breakdown By Service Tags In Last 7 Days - Column chart search"
},
"ds_9Pfseqrt": {
"type": "ds.chain",
"options": {
"query": "search _time=*\n| reverse | untable _time, tag, count\n| eventstats sum(count) as total_ss by _time\n| eval ss_perc=round(count/total_ss, 2)\n| table _time, tag, ss_perc\n| join _time\n [loadjob $ds_itsi_svc_usage_split_basesearch:job.sid$\n | table _time, itsi_svc_used\n ]\n| eval svc=ss_perc*itsi_svc_used\n| table _time, tag, svc\n| timechart span=24h first(svc) as svc by tag\n ",
"extend": "ds_itsi_svc_tag_split_basesearch"
},
"name": "ITSI SVC Breakdown By Service Tags In Last 7 Days - Column chart search"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {}
}
}
}
},
"inputs": {
"itsi_svc_used_tok": {
"options": {
"token": "itsi_svc_used_tok",
"defaultValue": "$ds_itsi_svc_usage_split_basesearch.results.itsi_svc_used"
}
}
},
"layout": {
"type": "grid",
"options": {
"height": 500,
"width": 1440
},
"structure": [
{
"item": "viz_zJdik26s",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 1440,
"h": 64
}
},
{
"item": "viz_lueLUDRq",
"type": "block",
"position": {
"x": 0,
"y": 64,
"w": 480,
"h": 288
}
},
{
"item": "viz_NeT2B7JH",
"type": "block",
"position": {
"x": 0,
"y": 352,
"w": 720,
"h": 306
}
},
{
"item": "viz_vN1wE0gq",
"type": "block",
"position": {
"x": 480,
"y": 64,
"w": 480,
"h": 288
}
},
{
"item": "viz_ccJrXxWt",
"type": "block",
"position": {
"x": 720,
"y": 352,
"w": 720,
"h": 306
}
},
{
"item": "viz_I4afjE3i",
"type": "block",
"position": {
"x": 960,
"y": 64,
"w": 480,
"h": 288
}
}
],
"globalInputs": []
},
"description": "This dashboard calculates SVC usage specific to 'Workload Pricing' model only",
"title": "ITSI SVC Statistics"
}
]]>