You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
120 lines
5.1 KiB
120 lines
5.1 KiB
<form>
|
|
<label>Event Sources</label>
|
|
<description>Click on the event source to check it on www.eventid.net</description>
|
|
<fieldset autoRun="true" submitButton="false">
|
|
<input type="time" searchWhenChanged="true">
|
|
<label>Select time range</label>
|
|
<default>
|
|
<earliest>-24h@h</earliest>
|
|
<latest>now</latest>
|
|
</default>
|
|
</input>
|
|
<input type="multiselect" token="Type" searchWhenChanged="true">
|
|
<label>Event types</label>
|
|
<default>Error</default>
|
|
<prefix>(</prefix>
|
|
<suffix>)</suffix>
|
|
<valuePrefix>Type="</valuePrefix>
|
|
<valueSuffix>"</valueSuffix>
|
|
<delimiter> OR </delimiter>
|
|
<search>
|
|
<query>`event_sources`| stats count by Type</query>
|
|
<earliest>$earliest$</earliest>
|
|
<latest>$latest$</latest>
|
|
</search>
|
|
<fieldForLabel>Type</fieldForLabel>
|
|
<fieldForValue>Type</fieldForValue>
|
|
</input>
|
|
<input type="multiselect" token="Computer" searchWhenChanged="true">
|
|
<label>Computer</label>
|
|
<choice value="*">All</choice>
|
|
<default>*</default>
|
|
<prefix>(</prefix>
|
|
<suffix>)</suffix>
|
|
<valuePrefix>ComputerName="</valuePrefix>
|
|
<valueSuffix>"</valueSuffix>
|
|
<delimiter> OR </delimiter>
|
|
<search>
|
|
<query>`event_sources` | stats count by ComputerName</query>
|
|
<earliest>$earliest$</earliest>
|
|
<latest>$latest$</latest>
|
|
</search>
|
|
<fieldForLabel>ComputerName</fieldForLabel>
|
|
<fieldForValue>ComputerName</fieldForValue>
|
|
</input>
|
|
<input type="text" token="keyword" searchWhenChanged="true">
|
|
<label>Keyword:</label>
|
|
<default>*</default>
|
|
</input>
|
|
</fieldset>
|
|
<row>
|
|
<panel>
|
|
<title>Event sources</title>
|
|
<table id="link">
|
|
<title>Click on the source to look it up on www.eventid.net</title>
|
|
<search>
|
|
<query>`event_sources` $Type$ AND $Computer$ AND $keyword$ | stats count as TotalEvents by SourceName</query>
|
|
</search>
|
|
<drilldown>
|
|
<link target="_blank">https://www.eventid.net/source-name-$row.SourceName$.htm</link>
|
|
</drilldown>
|
|
<option name="wrap">true</option>
|
|
<option name="rowNumbers">false</option>
|
|
<option name="dataOverlayMode">none</option>
|
|
<option name="count">10</option>
|
|
<option name="drilldown">cell</option>
|
|
</table>
|
|
</panel>
|
|
<panel>
|
|
<title>Event sources percentages</title>
|
|
<chart>
|
|
<search>
|
|
<query>`event_sources` $Type$ AND $Computer$ AND $keyword$ | stats count by SourceName</query>
|
|
</search>
|
|
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
|
|
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
|
|
<option name="charting.axisTitleX.visibility">visible</option>
|
|
<option name="charting.axisTitleY.visibility">visible</option>
|
|
<option name="charting.axisTitleY2.visibility">visible</option>
|
|
<option name="charting.axisX.scale">linear</option>
|
|
<option name="charting.axisY.scale">linear</option>
|
|
<option name="charting.axisY2.enabled">0</option>
|
|
<option name="charting.axisY2.scale">inherit</option>
|
|
<option name="charting.chart">pie</option>
|
|
<option name="charting.chart.bubbleMaximumSize">50</option>
|
|
<option name="charting.chart.bubbleMinimumSize">10</option>
|
|
<option name="charting.chart.bubbleSizeBy">area</option>
|
|
<option name="charting.chart.nullValueMode">gaps</option>
|
|
<option name="charting.chart.showDataLabels">none</option>
|
|
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
|
|
<option name="charting.chart.stackMode">default</option>
|
|
<option name="charting.chart.style">shiny</option>
|
|
<option name="charting.drilldown">all</option>
|
|
<option name="charting.layout.splitSeries">0</option>
|
|
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
|
|
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
|
|
<option name="charting.legend.placement">right</option>
|
|
</chart>
|
|
</panel>
|
|
</row>
|
|
<row>
|
|
<panel>
|
|
<title>Matching events - drill down option</title>
|
|
<event>
|
|
<search>
|
|
<query>`event_sources` $Type$ AND $Computer$ AND $keyword$| table _time, ComputerName, LogName, EventCode, SourceName, Type, Message, UserName</query>
|
|
</search>
|
|
<option name="type">table</option>
|
|
<option name="count">10</option>
|
|
<option name="list.drilldown">full</option>
|
|
<option name="list.wrap">1</option>
|
|
<option name="maxLines">5</option>
|
|
<option name="raw.drilldown">full</option>
|
|
<option name="rowNumbers">0</option>
|
|
<option name="table.drilldown">all</option>
|
|
<option name="table.wrap">1</option>
|
|
<fields>["ComputerName","LogName","EventCode","SourceName","Type","Message","UserName"]</fields>
|
|
</event>
|
|
</panel>
|
|
</row>
|
|
</form> |