ArcSight report query

[rohanparath]

Hi,

We have some queries regarding the reports generated from ArcSight ESM.

     

  1) Is it possible to show the value zero for a a report. For example, if I run a report for device count for a particular vendor and the value happens to be zero for a fixed time frame, the report comes up as blank. Can we show the report with the value zero.

   2) Similarly for the above example, if we have to depict this on a line graph, the line is not connected if for a particular day the device has not reported to ArcSight. Can we have the line graph show a zero value i.e. have all the dots connected for the line graph even if there is a zero value in between.

     

  3) Is there way to change the format of the x axis label for line graph report. For example the format that we see is "2012-07", we would like to change the format to "July, 2012".

Thanks

Rohan

[balahasan.v1]

Hi Rohan,

• For Line Graph Problem u can refer this:

https://protect724.arcsight.com/message/7879#7879

• For showing Zero in Report u need to use Active r Session List Values to Run the Report:

Ex: All Devices in AL. Then Query with the AL Entries and it's vaules.

Formatting X-Axis:

• You could use a set of Conditional Variables (IF MonthNum = 8 THEN 'August') but you would lose sorting functionality for the X Axis.  I would just stick to the month number.

If it is not clear i will work on it and attach screenshots if u want to.

Regards,

Balahasan.V

[rohanparath]

Hi Balahasan,

Thanks for the quick reply. Let me give those options a try and I will let you know if it worked.

Thanks once again.

Regards,

Rohan