Page Comparison

...

Code Block | eventcount summarize=false index=* index=_* | dedup index | rename count as countofevents | fields index countofevents | sort countofevents DESC

Image RemovedImage Added

Note: in order to conserve space on this page for the remaining queries,

...

In this section, we’ll discover broadly where/how to look for events that give an overall view of how our software is deployed and being used.

2.0 I am not sure what I am looking for, how do I just explore Splunk data?

index="main" earliest="-30m" source="mediabar"

2.1 List of customers and their CTI environment/location of agents (or at least URL agents use to access HIS)?

...

| tstats count WHERE (index="main"  earliest="8/1/2020:06:00:00"  latest="8/1/2020:06:30:00" source="mediabar" host="https://chewy.custhelp.com" ) 
BY _time logLevel crm.instanceId crm.groupId crm.id mb.className mb.functionName message span=1s

Or to simplify down to a few meaningful fields and one agent (but we don’t know which agent). If we know the agent id, the sub search can be removed which can be a performance issue in some cases.

| tstats count WHERE (index="main" earliest="-24h" host="https://faq.arval.it" 
[ | tstats count WHERE (index="main" earliest="-24h" host="https://faq.arval.it") BY crm.id | top limit=1 crm.id| rename count as c | rename percent as p | fields - c p | format]
) BY _time logLevel crm.id mb.className mb.functionName message span=1s  
| eval class='mb.className' . "-" . 'mb.functionName' | search class="*" | table _time logLevel crm.id class message

2.5 How to identify, at a high level, the major components in use by the customer?

Code Block index="main" earliest="8/3/2020:06:00:00" latest="8/3/2020:06:30:00" source="mediabar" | eval crmcust='crm.customer' | eval agent='crm.id' | eval class='mb.className' . "-" . 'mb.functionName' | search crmcust="*" agent="*" class="*" | stats values(class) as lc, count(class) as cc by crmcust, agent | where ((crmcust="veritas" AND cc > 1850) OR (crmcust="chewy" AND cc > 400) OR (crmcust="arval" AND cc > 1200)) At a quick glance simply of component, it can be easily determined if an agent is getting screen pops from Harmony or another way.

Image Added

Image Added

2. Omis Events

How to identify customer/agent using HIS/Harmony stack and how are they using it?

...

3. Popflow Events

How to identify customer/agent using Popflow and how they are using it?

...

2. Omis Events

...

4. Interaction Details