The Edit page is used create and edit reports.
Topics:
- How do I create a new report?
- How do I edit an existing report?
- How do I add sections to a report?
- How do I change section settings?
- How can I change the order of sections in a report?
- How can I remove a section from a report?
- How can I change the report name and description?
- How can I delete a report?
- How can I schedule a report to run?
- Why is the Test button disabled?
- Why is the Edit Schedule button disabled?
How do I create a new report?
To create a new report, click the New Report button. You will be prompted to select a Category for the report, and to enter a Report title and brief Description. Click Submit to create the report and start editing its contents.
How do I edit an existing report?
By default the Edit page shows a table listing all the user defined reports ordered by Category. Simply click on a report in the table to start editing it. If you want to list only reports within a particular Category, set the Category in the filter bar at the top of the page.
To return to the list of reports, change the Category at the top of the page to All.
How do I add sections to a report?
You must first select or create a report to be edited. Once the report is selected you will be presented with a table listing the report sections (this table will be empty if the report is new).
There are two ways to add sections to reports:
- Click on the New Section button and select a section (query) to add to the report. You will be returned to the section list with the newly added section at the bottom of the list. You will probably want to change the query settings associated with the new section; click on the Edit button to the right of the section to edit its settings. Click on the Test button to run the query and see what the results will look like in a report.
- Alternatively, you can add sections to the report you are currently editing by going to the Sentinel:Report>Query page. Select a query and when you are satisfied with the results, click on the Copy to Editor button and you will be returned to the section list with the new report section added to the end of the list.
Note: If the Test button next to a report section is disabled, this indicates that required parameters for the report section have not been configured. Click on the Edit button and fill in the missing parameters so that the section is properly configured.
How do I change section settings?
Click on the the Edit button to the right of the section you want to modify. Clicking on the Edit button opens the query form used to generate the data for the report section.
A query form has a tabular structure. Each row is used to specify a particular query parameter. The first column contains the parameter name, the second column contains the parameter input box, the third column may contain a "helper tool" that assist in filling in the input box and finally there may be a fourth column indicating any parameter values that are missing or have errors.
It is usually easier to set parameters using the helper tools rather than typing in settings directly into the input boxes. There are a number of types of helper tool:
- common options, consists of a selection box containing common values for the input. Changing the value in the helper sets the value of the input. Type directly into the query input box if you want to use a value that isn't in the list.
- list builder, consists of a selection box containing possible items to add to the input list. To add an item to the input list select it and click on the Add button. To clear all the items in the input list, click on the Clear button.
- filter builder, consists of a selection box containing attributes that can be compared, a selection box containing comparison operators and an input area to specify that values to be compared to the selected attribute. Clicking the Add button appends the comparison to the current filter. There are also boolean operator buttons (& and |) and bracket buttons that can be used to combine comparison expressions to form more complex filters. The filter builder only enables buttons and inputs when they are allowed in the filter expression that is being constructed.
Query forms may have a number of different inputs. There may be Usage information at the bottom of the form giving brief, form specific, instructions. In addition,there are a number of common fields that are found in many queries, including: Interval, Truncate, Group and Where.
The Interval input is specifies the time period over which the query will be run.
There are a number of predefined intervals, including:
- today
- yesterday
- thisweek
- lastweek
- thismonth
- lastmonth
- last24hours
- last7days
- last30days
- now - 2hours
- last tuesday
- midnight + 45 minutes
- 10pm yesterday,9am today
- 20051230
- 20051230,20060104
The Truncate input specifies the number of rows of result to be returned. Values from any truncated rows will be summed and will appear as one additional row at the bottom of a table, or as an Other category in a chart.
Note: If a result table contains fewer rows than the number specified by the truncate setting, then you will be sure that you have details for all the records that matches the query settings. A large truncate value can be used ensure that all records are returned. In this case you should still select a truncate value that ensures that the query won't fail because the server runs out of memory and that your web browser won't fail trying to display the result. A value of 1,000 is usually sufficient for most purposes.
The Group input is used when computing time series to specify the size of each time grouping within the overall query interval.
The group size can be specified either as a number of minutes, or using special tokens. The following examples show typical group values:
- 5
- minute
- hour
- day
- week
- month
- year
Finally, the Where input is used to specify a filter that will be applied during the query to select specific data.
A basic filter expression consists of the name of an attribute, an operator and a set of comma separated values. The allowed operators are:
- = equals
- != not equals
- ~ matches a reqular expression
- !~ does not match a regular expression
- & boolean AND
- | boolean OR
The following examples illustrate typical where filters:
- ipsource = 10.1.1.23
- ipdestination != 10.0.0.0/24,10.0.1.0/24
- serverport = TCP:80,TCP:81,TCP:8080-8088
- sourcezone ~ research.*
- ipsource = 10.0.0.1 & ipdestination = 10.0.0.2
- ipsource = 10.0.0.1 & (sourceport = TCP:80 | destinationport = TCP:80)
- sourcezone = EXTERNAL | destinationzone = EXTERNAL
WARNING Care should be taken if a value in a filter expression contains any of the following special characters: (, ), &, |, !, =, ~, ",', \, comma or space. If the value contains any of these characters then the whole value string can be enclosed in single or double quotes, or the special characters can be individually escaped with a \. The following examples show different ways of using the value "Research & Development" in filters:
- serverzone = "Research & Development", Sales
- clientzone = 'Research & Development'
- sourcezone = Research\ \&\ Development
- serverpath = ">>Research & Development>Data Center"
At any time, clicking on the Cancel button will close the form without making any changes. Click on the Reset button to undo mistakes and restore settings to the last saved values. Once you are satisfied with the changes, click on the Save Changes button to save the settings.
After saving it is usually a good idea to test the new settings using the Test button next to the report section. The Test button runs the query and shows how the modified section will look in a report.
Note: If the Test button next to a report section is disabled, this indicates that required parameters for the report section have not been configured. Click on the Edit button and fill in the missing parameters so that the section is properly configured.
How can I change the order of sections in a report?
When you have several report section in a report, you may want to change the order in which they appear. To move a section up or down the list, change the Order option for that section and set it to the position you want it to occupy, then click Reorder Sections.
How can I remove a section from a report?
Select the report you want to modify and click on the Remove button next to the section you want to delete.
How can I change the report name and description?
Select the report you want to modify and click on the Edit Heading button at the top of the page.
How can I delete a report?
Select the report you want to delete and click on the Delete Report button at the top of the page.
How can I schedule a report to run?
Select the report you want to schedule and click on the Edit Schedule button at the top of the page. You will be taken to the Sentinel:Report>Schedule settings for the report.
Note: A disabled Edit Schedule button indicates that one or more sections in the report have missing settings. Check to see if any of the sections in the report have a disabled Test button next to them, indicating that the section needs additional configuration settings to run. Click on the Edit button for the section to provide the missing information.
Why is the Test button disabled?
If the Test button next to a report section is disabled, this indicates that required parameters for the report section have not been configured. Click on the Edit button and fill in the missing parameters so that the section is properly configured.
Why is the Edit Schedule button disabled?
A report can only be scheduled to run if all of its sections are fully configured. Check to see if any of the sections in the report have a disabled Test button next to them, indicating that the section needs additional configuration settings to run. Click on the Edit button for the section to provide the missing information.