samuela1 Absent Member.
Absent Member.
310 views

Report Concantenation in ArcSight

I have a request from a customer to Join two reports developed on ArcSight. This report were generated from events coming from 2 different devices.

My Question;

Can this be achieved?

If yes, How can it be achieved?

if No, How can i go around the issue?

Thanks in Anticipation.

Labels (3)
0 Likes
Reply
4 Replies
anirudhanayak@g Outstanding Contributor.
Outstanding Contributor.

Re: Report Concantenation in ArcSight

Don't know whether I have understood it correctly.

Why don't you use Report Templates "Two Tables Portrait". By using this you can combine two queries into a single report and when you run the report it would archive.

And also you can refer the ESM_ArcSightConsole_UserGuide_6.5c starting page # 280

If your question is about combining two reports and then archiving it, then I need to have a check on this.

Please let me know if that helps.

Regards,

Anirudh

0 Likes
Reply
samuela1 Absent Member.
Absent Member.

Re: Report Concantenation in ArcSight

Anirudh,

Thanks for your response.

Actually placing the two tables side by side is quite easy, but the requirement is that Some information are missing in Report A, and report B needs to be used to enrich it. There is a common attribute between the two, which will be used as key to join the report together. Thats where concantenation comes in.

In summary, it is required of me to merge two reports together to form one report instead of having them side by side.

Regards.

0 Likes
Reply
Frequent Contributor.. ji52hale1 Frequent Contributor..
Frequent Contributor..

Re: Report Concantenation in ArcSight

I do something very similar to this.

I run a daily report which pulls data set "A" from Device1 and data set "B" from Device2 and combines them into a single, comprehensive report.  To achieve this, I use two trends and a single Active List.  Trend:A queries for my data set "A" and writes the results to my Active List.  Trend:B queries for my data set "B" and writes its results to the same Active List, only in different columns, using the common attributes as Key Fields.

Once my combined data set is ready, I run a separate query against the Active List and display those results in my daily report. The initial design of the Trend Queries, Trends, and Active List too a bit time (and more revisions than I would like to admit) but once it was complete and contained all the specific data fields I required, the daily overhead is almost non-existent.

I have even used this same "technique" for pulling different data fields from 3 and 4 different sources.  The important thing to remember is that with each additional data source, a new Trend is required.  Pre-planning is your friend.  Sit down with a piece of paper, or an XL spreadsheet, or some other brainstorming media and decide what fields you want in your final report, then work backwards on how to best mine that data.  In the long run, you will be glad you did.

0 Likes
Reply
samuela1 Absent Member.
Absent Member.

Re: Report Concantenation in ArcSight

Thanks Mitch Hale,

I understand your contribution, will give it a trial.

I will share with you what i came up with, reading your comment.

Best Regards.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.