Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
jack Absent Member.
Absent Member.
289 views

Grouping events in a report

Jump to solution

Hi,

  I'd like to create a report (McAfee ePO) like below

|Malware Resolved      |   Sum(Events: Device Action=cleaned, Device Action=deleted)|

|Malware Not Resolved|   Sum(Device Action=access denied)|

At the moment I have something like this

Device Action | Sum

cleaned          | 10

deleted           | 15

access denied|  2

How can I match (device action=cleaned, device action=deleteted) in a single row?

Labels (1)
Tags (1)
0 Likes
Reply
1 Solution

Accepted Solutions
dkeller Outstanding Contributor.
Outstanding Contributor.

Re: Grouping events in a report

Jump to solution

Jack,

Take a look at this thread: https://protect724.arcsight.com/message/12146

I think you can use similar logic. However, your conditional evaluation should set the value of only one variable to "resolved" or "not resolved" based on the conditions in your filter(s). Then group by this variable and present the count.

I hope this helps.

Doron

View solution in original post

0 Likes
Reply
2 Replies
dkeller Outstanding Contributor.
Outstanding Contributor.

Re: Grouping events in a report

Jump to solution

Jack,

Take a look at this thread: https://protect724.arcsight.com/message/12146

I think you can use similar logic. However, your conditional evaluation should set the value of only one variable to "resolved" or "not resolved" based on the conditions in your filter(s). Then group by this variable and present the count.

I hope this helps.

Doron

View solution in original post

0 Likes
Reply
jack Absent Member.
Absent Member.

Re: Grouping events in a report

Jump to solution

Thanks Doron for help

Jack

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.