UPDATE! The community will be go into read-only on April 19, 8am Pacific in preparation for migration on April 21. Read more.
UPDATE! The community will be go into read-only on April 19, 8am Pacific in preparation for migration on April 21.Read more.
Absent Member.
Absent Member.
299 views

ArcSight report query

Hi,

We have some queries regarding the reports generated from ArcSight ESM.

     

  1) Is it possible to show the value zero for a a report. For example, if I run a report for device count for a particular vendor and the value happens to be zero for a fixed time frame, the report comes up as blank. Can we show the report with the value zero.

  

   2) Similarly for the above example, if we have to depict this on a line graph, the line is not connected if for a particular day the device has not reported to ArcSight. Can we have the line graph show a zero value i.e. have all the dots connected for the line graph even if there is a zero value in between.

     

  3) Is there way to change the format of the x axis label for line graph report. For example the format that we see is "2012-07", we would like to change the format to "July, 2012".

Thanks

Rohan


Labels (1)
Tags (1)
0 Likes
2 Replies
Fleet Admiral
Fleet Admiral

Hi Rohan,

  • For Line Graph Problem u can refer this:

https://protect724.arcsight.com/message/7879#7879

  • For showing Zero in Report u need to use Active r Session List Values to Run the Report:

Ex: All Devices in AL. Then Query with the AL Entries and it's vaules.

Formatting X-Axis:

  • You could use a set of Conditional Variables (IF MonthNum = 8 THEN 'August') but you would lose sorting functionality for the X Axis.  I would just stick to the month number.

If it is not clear i will work on it and attach screenshots if u want to.

Regards,

Balahasan.V

0 Likes
Absent Member.
Absent Member.

Hi Balahasan,

Thanks for the quick reply. Let me give those options a try and I will let you know if it worked.

Thanks once again.

Regards,

Rohan

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.