Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
stephon.primous Absent Member.
Absent Member.
641 views

Can I Create a Report from a active channel.

Jump to solution

I have tried to create a report from one of my active channels but I am unable to get the field I need to display. Can any one help with this issue.  The feed is coming from an CISCO ACS

  The fields I need are :  Manager Time | User Name | Requested Action | Name or CMD | Target Address | Source Address | Category Outcome |

  Thanks in adance

Labels (1)
0 Likes
Reply
1 Solution

Accepted Solutions
jbur Absent Member.
Absent Member.

Re: Can I Create a Report from a active channel.

Jump to solution

The typical way to do this is:

  1. Save your filter from the active channel
  2. Create a query based off the filter
  3. Create a report based off the query

Hope this helps,

Joe

View solution in original post

0 Likes
Reply
12 Replies
jbur Absent Member.
Absent Member.

Re: Can I Create a Report from a active channel.

Jump to solution

The typical way to do this is:

  1. Save your filter from the active channel
  2. Create a query based off the filter
  3. Create a report based off the query

Hope this helps,

Joe

View solution in original post

0 Likes
Reply
stephon.primous Absent Member.
Absent Member.

Re: Can I Create a Report from a active channel.

Jump to solution

I tried that process, but some of the fields from the Active Channel were not available to query on. 

0 Likes
Reply
Established Member.. chrisb1
Established Member..

Re: Can I Create a Report from a active channel.

Jump to solution

Are you sure you weren't just missing them?  To the contrary, more data is available to queries than to an AC (due to variables and the such- not really more data, but you can do more with it).  If you can see it in an AC, you can query on it.

0 Likes
Reply
Mariajohn Absent Member.
Absent Member.

Re: Can I Create a Report from a active channel.

Jump to solution

Hi,

Add the required fields in ur active channel then right clk the active channel --> reports --> channel report.

May be this way is help you to get the report from active channel.

Regards,

John

0 Likes
Reply
balahasan.v1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Can I Create a Report from a active channel.

Jump to solution

Hi Guys,

Active Channel is for real time process so its Constantly Refreshes Data in it.

So running report with Same Condition is 1 Possible Way.

Else as Maria John M said u can Export the Events in Channel --> All in Channel (r) Selected Rows -->Save it

  • It ll Contain all the 208 Fields from Arcsight Fieldset.
  • U need to Change the Export data Options to get the Fields u want in Your Report.

Please revert in case of any Queries.

Thanks and Regards,

Balahasan.V

0 Likes
Reply
p.jagadish1 Absent Member.
Absent Member.

Re: Can I Create a Report from a active channel.

Jump to solution

hi stephon.primous,

You can add the fields on the active channel and save it as a field set and then select the events u need ,right click on the events and select export option in that option u can call the saved field set.

Regards,

Jagadish Pullappa

0 Likes
Reply
Acclaimed Contributor.. Volker Michels Acclaimed Contributor..
Acclaimed Contributor..

Re: Can I Create a Report from a active channel.

Jump to solution

That's how we do it and it works

0 Likes
Reply
Acclaimed Contributor.. Volker Michels Acclaimed Contributor..
Acclaimed Contributor..

Re: Can I Create a Report from a active channel.

Jump to solution

Hello Jagadish,

the disadvantage for an export is that it blocks your console and takes some time, a report will run in the background and you can use the console further.

Volker

0 Likes
Reply
p.jagadish1 Absent Member.
Absent Member.

Re: Can I Create a Report from a active channel.

Jump to solution

hi Volker

Above problem can be mitigated by selecting All tthe events in channal ant selecting the the option as shown in the screenshot.

Selected Rows.JPG

Jagadish

0 Likes
Reply
edwin.martinez. Absent Member.
Absent Member.

Re: Can I Create a Report from a active channel.

Jump to solution

Jagadish,

I must respectfully disagree. I ran an export today, similar to what Volker suggested, using the "selected rows only", and further activity via my console was blocked (as Volker states) until my export of 20 rows of an active channel (AC) was complete.

Perhaps you are running on a well-equipped or optimized server? Our SIM is heavily taxed, so my export might take longer compared to yours. In the end, when I need to push data from an AC, I usually run a report using a query based upon the filter I use in my AC. In this manner, I can continue working in my console until the report is complete and the SIM asks if I would like to view or save the report.

Edwin

0 Likes
Reply
stephon.primous Absent Member.
Absent Member.

Re: Can I Create a Report from a active channel.

Jump to solution

That's what I thought also but it does not work for me. I even had ArcSight on site.

0 Likes
Reply
Acclaimed Contributor.. Volker Michels Acclaimed Contributor..
Acclaimed Contributor..

Re: Can I Create a Report from a active channel.

Jump to solution

Hello,

so the easiest way is the following:

add all columns you want to have in a report to the channel ind the order you want to see it.

Mark the events you want to have in the report.

Move with your mouse pointer over the left column (where you see eg the blizzard for the correlated events) - don't click!!

CTRL+C

Open a notepad

CTRL+V

Now you have all events in a csv format.

Volker

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.