splunk-stuff/squid-forms.xml at master · alvarow/splunk-stuff · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
<form>
  <label>Squid Requests search</label>
  <searchTemplate>index="squid" sourcetype="squid" clientip="$clientip$" uri_host="$uri_host$" uri_path="$uri_path$"</searchTemplate>
  <fieldset submitButton="true" autoRun="true">
    <input type="text" token="clientip">
      <label>Client IP</label>
      <seed>*</seed>
    </input>
    <input type="text" token="uri_host">
      <label>Destination hostname</label>
      <seed>*</seed>
    </input>
    <input type="text" token="uri_path">
      <label>Requested URL</label>
      <seed>*</seed>
    </input>
    <input type="time"></input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Requests over time for result set</title>
        <search base="global">
          <query>timechart count as "Requests"</query>
        </search>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Top client IPs in result set</title>
        <search base="global">
          <query>top 10 clientip</query>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Top destination sites in result set</title>
        <search base="global">
          <query>top 10 uri_host</query>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Requests in result set</title>
        <!-- searchPostProcess>sort - _time | fields _time, clientip, uri_host, uri_path</searchPostProcess -->
        <fields>_time, clientip, uri_host, uri_path, bytes</fields>
        <option name="showPager">true</option>
        <option name="count">30</option>
        <option name="displayRowNumbers">false</option>
      </table>
    </panel>
  </row>