<!--
SPDX-FileCopyrightText: 2024 Splunk, Inc.
SPDX-License-Identifier: LicenseRef-Splunk-8-2021
-->

<form version="1.1" theme="dark">
    <label>Microsoft Windows Monitoring Dashboard</label>
    <fieldset submitButton="false" autoRun="true">
        <input type="time" token="log_time">
        <label>Time</label>
        <default>
            <earliest>-4h@m</earliest>
            <latest>now</latest>
        </default>
    </input>
    <input type="dropdown" token="index_name">
        <label>Index</label>
        <fieldForLabel>index</fieldForLabel>
        <fieldForValue>index</fieldForValue>
        <search>
            <query>| eventcount summarize=false index=* | dedup index | table index</query>
            <earliest>-24h@h</earliest>
            <latest>now</latest>
        </search>
        <default>main</default>
        </input>
        <input type="multiselect" token="host_name">
            <label>Host</label>
            <choice value="*">All</choice>
            <default>*</default>
            <fieldForLabel>host</fieldForLabel>
            <fieldForValue>host</fieldForValue>
            <search>
                <query>| tstats count where index=$index_name$ by host
        | table host</query>
                <earliest>0</earliest>
                <latest></latest>
            </search>
            </input>
        <input type="multiselect" token="sourcetype_token">
        <label>Sourcetypes</label>
        <choice value="*">All</choice>
        <default>*</default>
        <fieldForLabel>sourcetype</fieldForLabel>
        <fieldForValue>sourcetype</fieldForValue>
        <search>
            <query>| tstats count where index=$index_name$  AND host IN ($host_name$) AND
    sourcetype IN ("PerfmonMk:*", "Perfmon:*", "MSAD:*", "WindowsUpdateLog", "WMI:*","WinEventLog","Script:NetworkConfiguration",  "Script:TimesyncConfiguration",  "ActiveDirectory", "WinHostMon", "WinRegistry", "Script:InstalledApps", "DhcpSrvLog", "wmi", "Script:ListeningPorts", "XmlWinEventLog:*", "host::WinEventLogForwardHost", "WinEventLog:*", "Script:TimesyncStatus", "XmlWinEventLog","powershell", "WinRegMon", "admon", "WinNetMon", "WinPrintMon", "win:bios") AND NOT sourcetype IN ("winEventLog:*", "xmlWinEventLog:*")  by sourcetype
    | table sourcetype</query>
            <earliest>0</earliest>
            <latest></latest>
        </search>
        </input>
        <input type="multiselect" token="source_token">
        <label>Sources</label>
        <choice value="*">All</choice>
        <default>*</default>
        <fieldForLabel>source</fieldForLabel>
        <fieldForValue>source</fieldForValue>
        <search>
            <query>| tstats values(source) where index=$index_name$ AND sourcetype IN ($sourcetype_token$)  AND host IN ($host_name$) AND source IN ("WinEventLog:*", "WMI*", "WinEventLog*", "XmlWinEventLog:*", "*WindowsUpdate.Log", "WMI:WinEventLog*", "Powershell", "service", "processor", "process", "printer", "port","outbound","networkadapter","operatingsystem","inbound", "driver","disk","computer", "roles","WinRegistry", "PerfmonMk:*", "*win_timesync_status.bat","*win_timesync_configuration.bat","*win_listening_ports.bat", "*win_installed_apps.bat", "*netsh_address.bat", "*DHCP" ,"*netlogon.log","*dns.log")  by source
    | table source</query>
            <earliest>0</earliest>
            <latest></latest>
        </search>
        <delimiter> </delimiter>
        </input>
    </fieldset>
    <row>
        <panel>
        <title>Windows TA version</title>
        <single>
            <search>
            <query>| rest services/apps/local/Splunk_TA_windows splunk_server=local| fields version</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
            <option name="refresh.display">progressbar</option>
        </single>
        </panel>
        <panel>
        <title>Total number of events</title>
        <single>
            <search>
            <query>index=$index_name$ sourcetype IN ($sourcetype_token$) source IN ($source_token$) host IN ($host_name$) eventtype=windows_ta_data | stats count</query>
            <earliest>$log_time.earliest$</earliest>
            <latest>$log_time.latest$</latest>
            </search>
            <option name="drilldown">none</option>
            <option name="refresh.display">progressbar</option>
        </single>
        </panel>
    </row>
    <row>
        <panel>
        <title>Event count per time span</title>
        <input type="dropdown" token="span_time">
            <label>TIme span</label>
            <choice value="1s">1 second</choice>
            <choice value="10s">10 seconds</choice>
            <choice value="1m">1 minute</choice>
            <choice value="15m">15 minutes</choice>
            <choice value="30m">30 minutes</choice>
            <choice value="1h">1 hour</choice>
            <choice value="12h">12 hours</choice>
            <choice value="24h">24 hours</choice>
            <default>12h</default>
        </input>
        <chart>
            <search>
            <query>index=$index_name$  sourcetype IN ($sourcetype_token$) source IN ($source_token$)  host IN ($host_name$) eventtype=windows_ta_data| timechart span=$span_time$ count as "Event count"</query>
            <earliest>$log_time.earliest$</earliest>
            <latest>$log_time.latest$</latest>
            <refresh>5m</refresh>
            <refreshType>delay</refreshType>
            </search>
            <option name="charting.chart">line</option>
            <option name="charting.drilldown">none</option>
            <option name="refresh.display">progressbar</option>
        </chart>
        </panel>
    </row>
    <row>
        <panel>
        <title>Events by Sourcetypes</title>
        <chart>
            <search>
            <query>index=$index_name$  sourcetype IN ($sourcetype_token$) source IN ($source_token$)  host IN ($host_name$) eventtype=windows_ta_data| stats count by sourcetype</query>
            <earliest>$log_time.earliest$</earliest>
            <latest>$log_time.latest$</latest>
            <sampleRatio>1</sampleRatio>
            </search>
            <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
            <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.axisX.abbreviation">none</option>
            <option name="charting.axisX.scale">linear</option>
            <option name="charting.axisY.abbreviation">none</option>
            <option name="charting.axisY.scale">linear</option>
            <option name="charting.axisY2.abbreviation">none</option>
            <option name="charting.axisY2.enabled">0</option>
            <option name="charting.axisY2.scale">inherit</option>
            <option name="charting.chart">pie</option>
            <option name="charting.chart.bubbleMaximumSize">50</option>
            <option name="charting.chart.bubbleMinimumSize">10</option>
            <option name="charting.chart.bubbleSizeBy">area</option>
            <option name="charting.chart.nullValueMode">gaps</option>
            <option name="charting.chart.showDataLabels">none</option>
            <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
            <option name="charting.chart.stackMode">default</option>
            <option name="charting.chart.style">shiny</option>
            <option name="charting.drilldown">none</option>
            <option name="charting.layout.splitSeries">0</option>
            <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
            <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
            <option name="charting.legend.mode">standard</option>
            <option name="charting.legend.placement">right</option>
            <option name="charting.lineWidth">2</option>
            <option name="height">331</option>
            <option name="refresh.display">progressbar</option>
            <option name="trellis.enabled">0</option>
            <option name="trellis.scales.shared">1</option>
            <option name="trellis.size">medium</option>
        </chart>
        </panel>
        <panel>
        <title>Events by Sources</title>
        <chart>
            <search>
            <query>index=$index_name$  sourcetype IN ($sourcetype_token$) source IN ($source_token$)  host IN ($host_name$) eventtype=windows_ta_data| stats count by source</query>
            <earliest>$log_time.earliest$</earliest>
            <latest>$log_time.latest$</latest>
            </search>
            <option name="charting.axisY.abbreviation">none</option>
            <option name="charting.chart">pie</option>
            <option name="charting.chart.showDataLabels">all</option>
            <option name="charting.drilldown">none</option>
            <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
            <option name="height">332</option>
            <option name="refresh.display">progressbar</option>
        </chart>
        </panel>
    </row>
    <row>
        <panel>
        <title>Trends of events by sourcetypes</title>
        <table>
            <search>
            <query>index=$index_name$  sourcetype IN ($sourcetype_token$) source IN ($source_token$) host IN ($host_name$) eventtype=windows_ta_data| chart sparkline(count) AS "Sourcetypes Trend" count AS Total BY sourcetype</query>
            <earliest>$log_time.earliest$</earliest>
            <latest>$log_time.latest$</latest>
            <sampleRatio>1</sampleRatio>
            </search>
            <option name="count">10</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="percentagesRow">false</option>
            <option name="refresh.display">progressbar</option>
            <option name="rowNumbers">false</option>
            <option name="totalsRow">false</option>
            <option name="wrap">true</option>
        </table>
        </panel>
        <panel>
        <title>CIM Supported Events</title>
        <table>
            <title>Total events mapped with tags</title>
            <search>
            <query>index=$index_name$  sourcetype IN ($sourcetype_token$)  source IN ($source_token$) host IN ($host_name$) eventtype=windows_ta_data| stats count As TotalEvents by tag | table tag,  TotalEvents</query>
            <earliest>$log_time.earliest$</earliest>
            <latest>$log_time.latest$</latest>
            </search>
            <option name="drilldown">none</option>
            <option name="refresh.display">progressbar</option>
        </table>
        </panel>
    </row>
</form>
