Graphical view for a log entry into dynatrace

[gauravpayghan__]

The below one is the log entry!

in the above content using etime I need graphical view in dynatrace with respect to dashboard!

Please assist me on this how it can be achieved and what steps to be followed!

================================

[21/Apr/2025:11:32:31.682 -0500] SEARCH RESULT instanceName="xyz" threadID=42 conn=***63 op=***49 msgID=***50 requesterIP="*****128" requesterDN="cn=CN=*****d.aa.com\,O=Ping Identity Certificate,cn=Internal,cn=Root DNs,cn=config" usingAdminSessionWorkerThread=true requestControls="1.3.6.1.4.1.30221.2.5.42" base="cn=monitor" scope=1 filter="(&(objectclass=ds-mirrored-subtree-monitor-entry)(subtree-base-dn=cn=Topology,cn=config))" attrs="master-server-startup-uuid,num-inbound-connections,start-time,last-time-master,is-master-server,should-be-master,forced-as-master,removed-from-topology-at-timestamp,subtree-digest,subtree-digest-v2,baseline-subtree-version,current-subtree-version,server-state,connected-peer,baseline-subtree-digest,subtree-config-model-digest" resultCode=0 resultCodeName="Success" qtime=0 etime=0.405 interServerComponent="Mirrored subtree manager for base DN 'cn=Topology,cn=config'" interServerOperationPurpose="Topology monitoring and master selection" usedPrivileges="bypass-acl" preAuthZUsedPrivileges="bypass-acl,use-admin-session" entriesReturned=1

===================

Do suggest the steps properly!

jason_gs@gaddenna_n_k @dannemca @Michal_Gebacki @dynadynat@florian_g @Mizső 

[PacoPorro]

Could you please elaborate your question?

[gauravpayghan__]

Basically, the requirement is for the logs that are getting generated into dynatrace with content like BIND, ADD, Delete, Search like this.

The Client wants to get a visual presentation of this for a timeperiod like to get the actual count like how many bind or add or delete logs are generated - it needs to be displayed into the dashboard.

So this is the requirement and we want to achieve it - the previous configuration was done for splunk and the same they want into dynatrace - for example 1 hrs timeperiod a visual presentation needs to display with BIND logs like for 10 mins it appear for 10 times then another 10 mins it appear for 15 times like this.

Hope you get it now do reply now with answer

==========================

BIND:
[04/Apr/2025:11:38:43.754 -0500] BIND RESULT instanceName="useffff" threadID=22206623 conn=-89610495 op=173796377 msgID=173796378 origin="Directory REST API" requesterIP="internal" version="3" dn="uid=00861573,ou=people,ou=internal,dc=aa,dc=com" authType="SIMPLE" resultCode=0 resultCodeName="Success" etime=2.602 authDN="uid=00861573,ou=people,ou=internal,dc=aa,dc=com" clientConnectionPolicy="* internal client connection policy *"

SEARCH:
[02/Apr/2025:09:51:48.584 -0500] SEARCH ENTRY instanceName="uuseffff" threadID=20357819 conn=-80823145 op=157240687 msgID=157240688 origin="Directory REST API" httpRequestID="10763632" correlationID="d21af3d8-6759-4093-b7d4-8432f12a029d" authDN="uid=00861573,ou=people,ou=internal,dc=aa,dc=com" clientConnectionPolicy="default" requesterIP="internal" requesterDN="uid=00861573,ou=people,ou=internal,dc=aa,dc=com" base="" scope=0 filter="(objectClass=)" attrs="+,altServer,changelog,firstChangeNumber,lastChangeNumber,lastPurgedChangeNumber,namingContexts,subschemaSubentry,supportedAuthPasswordSchemes,supportedControl,supportedExtension,supportedFeatures,supportedLDAPVersion,supportedSASLMechanisms,vendorName,vendorVersion" dn=""

MODIFY:
[02/Apr/2025:07:35:48.203 -0500] MODIFY RESULT instanceName="uuseffff" threadID=497 conn=-10 op=165655673 msgID=165655674 origin="replication" requesterIP="internal" requesterDN="" dn="uid=00861573,ou=people,ou=internal,dc=aa,dc=com" resultCode=0 resultCodeName="Success" etime=1.519 usedPrivileges="bypass-acl" replicationChangeID="00000195F6802567653913010E7D"

ADD:
[28/Mar/2025:02:24:44.311 -0500] ADD RESULT instanceName="useruseffff" threadID=9 conn=15615408 op=27 msgID=28 requesterIP="10.232.8.209" requesterDN="uid=Z1050673,ou=functional,ou=internal,dc=aa,dc=com" dn="uid=00955635,ou=people,ou=internal,dc=aa,dc=com" resultCode=0 resultCodeName="Success" qtime=0 etime=4.850 localAssuranceLevel="PROCESSED_ALL_SERVERS" remoteAssuranceLevel="NONE" assuranceTimeoutMillis=1000 responseDelayedByAssurance=true replicationChangeID="00000195DBA38F9343C318994E0D"

DELETE:
[31/Mar/2025:16:47:45.403 -0500] DELETE RESULT instanceName="useuseffff" threadID=22642075 conn=-70935915 op=137520993 msgID=137520994 origin="Directory REST API" httpRequestID="9414483" correlationID="9d59a681-e632-4693-881e-01ad17029411" authDN="uid=Z2131279,ou=functional,ou=internal,dc=aa,dc=com" clientConnectionPolicy="default" requesterIP="internal" requesterDN="uid=Z2131279,ou=functional,ou=internal,dc=aa,dc=com" requestControls="1.3.6.1.4.1.30221.2.5.2" via="app='PingDirectory-userstore6' clientIP='10.232.8.209' requestID='9d59a681-e632-4693-881e-01ad17029411'" dn="cn=manifrecon,ou=onboarding,ou=pdselfservice,ou=internal,dc=aa,dc=com" resultCode=0 resultCodeName="Success" etime=7.848 localAssuranceLevel="PROCESSED_ALL_SERVERS" remoteAssuranceLevel="NONE"
==========

need to display the count of how many BIND and search and ADD operations happened in a timeperiod

[Mizső]

Hi @gauravpayghan__ 

In Classic Log monitoring chose your source and filter to the required contet (Eg. BIND RESULT). Then creating a log metric. You can use these log metrics for vizualization. This is the most simple solution for it.

I hope it helps.

Best regards,

János

[gauravpayghan__]

Dear Miszo,

We are doing the same thing - like fetch logs then create a metric for the same but it is not reflecting into the data explorer as well as into the Metrics. We are not sure here why it is not reflecting. Even post creating it the the required logs are getting generated - for capture purpose but it's not visible into metrics.

Please help me with the above steps how the created metric will start reflecting into DT.

[gauravpayghan__]

Dear Mizso,

I am getting the metric in metrics now as well as in data explorer after it fetches sm data it is visible.

Now the requirement is when i pin it to dashboard and shows the records as per respected graph but i want them to be drilled down by clicking it from dashboard only.

For example - i see there's 5 records for bind search in last 10 minutes then if i want to check them directly how it can be possible as i tried directly clicking it via dashboard but it's not opening. I want a solution on this!

[PacoPorro]

So, the requirement is to drill down from the metric to the actual log entry? @gauravpayghan__ 

[sia_h]

You can make use of makeTimeseries in DQL. E.g.

fetch logs
| filter matchesPhrase(content, "Directory REST API") AND matchesPhrase(content, "BIND")
| makeTimeseries count()