macros.conf

[replication_status_filespace]
definition = `lastdb("occupancy")` | search tsmserver=TSM514 OR tsmserver=TSM614 | rename NODE_NAME AS node FILESPACE_NAME AS filespace_name | stats first(FILESPACE_ID) AS filespace_id sum(LOGICAL_MB) AS logical_mb sum(PHYSICAL_MB) AS physical_mb sum(REPORTING_MB) AS reporting_mb sum(NUM_FILES) AS num_files by _time,tsmserver,node,filespace_name | stats sum(eval(if(tsmserver="TSM514", logical_mb, 0))) AS TSM514_logical_mb sum(eval(if(tsmserver="TSM514", physical_mb, 0))) AS TSM514_physical_mb sum(eval(if(tsmserver="TSM514", reporting_mb, 0))) AS TSM514_reporting_mb sum(eval(if(tsmserver="TSM514", num_files, 0))) AS TSM514_num_files sum(eval(if(tsmserver="TSM614", logical_mb, 0))) AS TSM614_logical_mb sum(eval(if(tsmserver="TSM614", physical_mb, 0))) AS TSM614_physical_mb sum(eval(if(tsmserver="TSM614", reporting_mb, 0))) AS TSM614_reporting_mb sum(eval(if(tsmserver="TSM614", num_files, 0))) AS TSM614_num_files by _time,node,filespace_name
iseval = 0

[replication_status_node]
definition = `replication_status_filespace` | stats sum(TSM514_logical_mb) AS TSM514_logical_mb sum(TSM514_physical_mb) AS TSM514_physical_mb sum(TSM514_reporting_mb) AS TSM514_reporting_mb sum(TSM514_num_files) AS TSM514_num_files sum(TSM614_logical_mb) AS TSM614_logical_mb sum(TSM614_physical_mb) AS TSM614_physical_mb sum(TSM614_reporting_mb) AS TSM614_reporting_mb sum(TSM614_num_files) AS TSM614_num_files by _time,node
iseval = 0

[tape_mounts(1)]
args = library
definition = index=tsmlogs tapelibrary=$library$ (tsmcode=ANR8337I AND NOT server_type=library_manager) OR tsmcode=ANR8468I | dedup _raw | transaction tapedrive,tapevolume maxopentxn=32 keepevicted=true startswith="tsmcode=ANR8337I" | search closed_txn=1 | eval duration=if(linecount=1, now()-_time, duration) | concurrency duration=duration start=_time | sort -_time
iseval = 0

[drive_status(1)]
args = library
definition = inputlookup driveinfo | search LIBRARY_NAME=$library$ | join type=outer DRIVE_NAME [search index=fcsmon | stats latest(in_speed_kb) AS in_speed_kb latest(out_speed_kb) AS out_speed_kb latest(port_wwn) AS port_wwn by host,port | join port_wwn [| inputlookup driveinfo | search LIBRARY_NAME=$library$ | makemv DRIVE_WWNS | mvexpand DRIVE_WWNS | rename DRIVE_WWNS AS port_wwn] | eval speed_mbps=round(max(in_speed_kb,out_speed_kb)/1024,2) | fields DRIVE_NAME speed_mbps] | rename DRIVE_NAME AS tapedrive | join type=outer tapedrive [search `tape_mounts("$library$")` | search linecount=1 ] | dedup tapedrive | eval durationstr=tostring(duration,"duration") | join type=outer tsmserver tapevolume [search SESSION_TYPE!=Admin `session_info` | eval operation=case(SESSION_TYPE=="Server", "replication from " + OWNER_NAME, isnotnull(INPUT_VOL_ACCESS), "restore", isnotnull(OUTPUT_VOL_ACCESS), "backup") | rename CLIENT_NAME AS node volume AS tapevolume] | join type=outer tsmserver tapevolume [search `lastdb("processes")` | rex field=STATUS "(?<tapevolume>I\d{5})" max_match=3 | mvexpand tapevolume | rex field=STATUS max_match=2 "[Pp]ool (?<pool>\w+)" | eval pool=" ("+mvjoin(pool, " → ")+")" | fillnull value="" pool | rex field=STATUS "NAS Node (?<node>[^,]+)," | eval operation=if(isnotnull(node), PROCESS, "")] | eval speed_mbps=if(isnull(tsmserver), "", speed_mbps) | rename tapedrive AS Drive tsmserver AS "TSM Server" tapevolume AS Volume durationstr AS "Mount Time" speed_mbps AS "Speed (MB/s)" | eval "Used by"=case(ONLINE == "NO", "** OFFLINE", ONLINE == "UNKNOWN", "** UNKNOWN", ONLINE != "YES", "** " . ONLINE, isnotnull(node), node + " (" + operation + ")", PROCESS!="", PROCESS + pool) | table Drive "TSM Server" Volume "Mount Time" "Used by" "Speed (MB/s)" | sort Drive

[gantt_mounts]
definition = index=tsmlogs tsmcode=ANR8468I OR tsmcode=ANR8337I server_type=user | dedup _time tapedrive tapevolume | transaction tapedrive,tapevolume,tsmserver,session maxevents=2 | addinfo | eval duration=if(eventcount=1, case(tsmcode="ANR8337I", info_max_time-_time, tsmcode="ANR8468I", _time-info_min_time), duration) | eval _time=if(eventcount=1 AND tsmcode="ANR8468I", info_min_time, _time) | eval extras="{\"Session\":\""+session+"\",\"Tape Volume\":\""+tapevolume+"\",\"Server Usage\":\""+server_usage+"\"}" | sort starttime asc

[gantt_mounts_process]
definition = index=tsmlogs tsmcode=ANR8468I OR tsmcode=ANR8337I server_type=user | dedup _time tapedrive tapevolume | transaction tapedrive,tapevolume,tsmserver,session maxevents=2 | addinfo | eval duration=if(eventcount=1, case(tsmcode="ANR8337I", info_max_time-_time, tsmcode="ANR8468I", _time-info_min_time), duration) | eval _time=if(eventcount=1 AND tsmcode="ANR8468I", info_min_time, _time) | join type=outer tsmserver process [search index=tsmlogs tsmcode=ANR0984I | rex "Process \d+ for (?<process_name>.*) started" | fields tsmserver process process_name] | join type=outer tsmserver session [search index=tsmlogs tsmcode=ANR0406I [search index=tsmlogs tsmcode=ANR8337I server_type=user | fields tsmserver session] | eval process_name="User Session" | rex "ANR0406I Session (?<session>\d+) started " | fields tsmserver session process_name node] | join type=outer tsmserver session [search index=tsmlogs tsmcode=ANE4991I (ANU2527I OR ANU2526I) [search index=tsmlogs tsmcode=ANR8337I server_type=user | fields tsmserver session] | eval op_name=if(searchmatch(" ANU2527I "), "DB Restore", if(searchmatch(" ANU2526I "), "DB Backup", "")) | rex "ANR0406I Session (?<session>\d+) started " | fields tsmserver session op_name] | eval process_name=if(process_name="User Session" AND isnotnull(op_name), process_name+" - "+op_name , process_name) | fillnull value="undefined" process_name | eval node_extra=if(isnotnull(node), "\"Node Name\":\""+node+"\",", "") | eval extras="{\"Tape Volume\":\""+tapevolume+"\",\"Session\":\""+session+"\","+node_extra+"\"TSM Server\":\""+tsmserver+"\",\"Server Usage\":\""+server_usage+"\"}" | sort starttime asc

[gantt_migrations]
definition = index=tsmlogs migration (tsmcode=ANR0984I OR tsmcode=ANR0986I OR tsmcode=ANR0985I) | rex "total of (?<bytes>[\d,]+) bytes" | eval megabytes=tonumber(replace(bytes, ",", ""))/1024/1024 | transaction tsmserver,session,process | eval speed_mbps=megabytes/duration | eval speed=case(speed_mbps>=170, "+170", speed_mbps>=150, "150-170", speed_mbps>=130, "130-150", speed_mbps>=110, "110-130", speed_mbps>=90, "90-110", speed_mbps>=70, "70-90", speed_mbps>=50, "50-70", speed_mbps>=30, "30-50", speed_mbps>=0, "<30") + " MB/s" | fillnull value="unknown" speed | fillnull value=0 speed_mbps | addinfo | eval duration=if(eventcount=1, case(tsmcode="ANR0984I", info_max_time-_time, tsmcode="ANR0986I", _time-info_min_time), duration) | eval _time=if(eventcount=1 AND tsmcode="ANR0986I", info_min_time, _time) | eval extras="{\"Session\":\""+session+"\",\"Process\":\""+process+"\",\"Speed\":\""+tostring(round(speed_mbps,2), "commas")+" MB/s\"}" | sort speed_mbps