macros.conf

[tsmdb(1)]
description = Get the results for a given TSM table
args = table
definition = index=tsmdb tag::sourcetype="st_$table$"

[lastdb(1)]
description = Get the latest results for a given TSM table for all servers
args = table
definition = `tsmdb("$table$")` | eval time=_time | search [search `tsmdb("$table$")` | stats latest(_time) AS time by tsmserver | fields tsmserver time] | fields - time

[lastdb(2)]
description = Get the latest results for a given TSM table and servers (more efficient than lastdb(1))
args = table, server
definition = `tsmdb("$table$")` tsmserver=$server$ | streamstats latest(_time) AS first_time | head (_time = first_time) | fields - first_time

[lastdb_time(2)]
description = Get the latest results for a given TSM table for all servers, within a specified time period
args = table,time
definition = $time$ `tsmdb("$table$")` | eval time=_time | search [search $time$ `tsmdb("$table$")` | stats latest(_time) AS time by tsmserver | fields tsmserver time] | fields - time

# Formatting data
[scalekb(2)]
args = source,destination
definition = eval $destination$=case($source$>=1099511627776, 5, $source$>=1073741824, 4, $source$>=1048576, 3, $source$>=1024, 2, $source$>=0, 1, $source$<0, 0 )

[convertkb(2)]
args = source,minimum
definition = `scalekb($minimum$, $minimum$_order)` | eval $source$=$source$/pow(1024, $minimum$_order-1)

[convertmb(2)]
args = source,minimum
definition = `convertkb($source$, $minimum$)` | eval $minimum$_order=$minimum$_order+1

[order_to_namekb(1)]
args = order
definition = eval $order$=case($order$==0, "Bytes", $order$==1, "Kilobytes", $order$==2, "Megabytes", $order$==3, "Gigabytes", $order$==4, "Terabytes", $order$==5, "Petabytes")

[format(3)]
args = name,value,suffix
definition = eval "$name$"=round($value$, 2) | fieldformat "$name$"=if('$name$'>0, "+", "") . tostring('$name$', "commas") . "$suffix$"
iseval = 0

[format(2)]
args = name,value
definition = `format($name$, $value$, "")`
iseval = 0


[filter_contacts]
description = Filter results based on what the user should see, given a CONTACT field
definition = search [| inputlookup contactinfo | search [rest /services/authentication/current-context/context | fields + username] | fields contact | rename contact AS CONTACT]

[filter_nodes(1)]
description = Filter results based on what the user should see, given only a node name (ie. look up the contact first)
args = fnodes
definition = lookup nodeinfo tsmserver NODE_NAME AS $fnodes$ output CONTACT | `filter_contacts`

[contact_deptgroup(1)]
description = Look up the department and group of a contact in the given table
args = fcontact
definition = lookup contactinfo contact AS $fcontact$ OUTPUT contact_dept contact_group | eval contact_dept=mvindex(contact_dept, 0) | eval contact_group=mvindex(contact_group, 0)

[node_alerts]
description = Check whether a node is alerted based on the no alert periods and the default alerting status. Default to YES
definition = lookup nodeinfo tsmserver NODE_NAME AS node OUTPUT ALERTS_DEFAULT | lookup nodealerts tsmserver node OUTPUT alert AS ALERTS | eval ALERTS=coalesce(ALERTS, ALERTS_DEFAULT, "YES") | fields - ALERTS_DEFAULT

[date_next(2)]
description = Given a start date, find the next Sunday/Monday/.../Weekend/Weekday/Any
args = start, next
definition = eval $start$=mvrange($start$, relative_time($start$, "+7d"), "1d") | eval $start$=min(case($next$="Sunday", mvfilter(strftime($start$, "%w") == "0"), $next$="Monday", mvfilter(strftime($start$, "%w") == "1"), $next$="Tuesday", mvfilter(strftime($start$, "%w") == "2"), $next$="Wednesday", mvfilter(strftime($start$, "%w") == "3"), $next$="Thursday", mvfilter(strftime($start$, "%w") == "4"), $next$="Friday", mvfilter(strftime($start$, "%w") == "5"), $next$="Saturday", mvfilter(strftime($start$, "%w") == "6"), $next$="Weekday", mvfilter(tonumber(strftime($start$, "%w")) > 0 AND tonumber(strftime($start$, "%w")) < 6), $next$="Weekend", mvfilter(strftime($start$, "%w") == "0" OR strftime($start$, "%w") == "6"), $next$="Any", $start$))

[schedule_desc]
description = Give a textual description of the schedule parameters
definition = eval schedule_desc="Every " + if(PERIOD=1, case(DAYOFWEEK="Weekday" OR DAYOFWEEK="Weekend", lower(DAYOFWEEK), DAYOFWEEK="Any", lower(rtrim(PERUNITS, "S")),  DAYOFWEEK!="Any", DAYOFWEEK), PERIOD + " " + lower(PERUNITS)) + if(DAYOFWEEK!="Any" AND (PERIOD!=1 AND DAYOFWEEK!="Weekday" AND DAYOFWEEK!="Weekend"), " on " + if(DAYOFWEEK="Weekday" OR DAYOFWEEK="Weekend", "a " + lower(DAYOFWEEK), DAYOFWEEK),"") + if(PERUNITS="HOURS", " starting at " + STARTTIME, " between " + STARTTIME + " and " + strftime(relative_time(strptime(STARTDATE+STARTTIME, "%F%T"), "+"+DURATION+"h"), "%T"))

[schedule_info]
description = Show all schedules for all nodes, as well as their last status and when they last completed successfully
definition = inputlookup scheduleinfo | join type=outer tsmserver NODE_NAME SCHEDULE_NAME [| inputlookup schedulestatus | sort - status_time | stats first(status) AS status first(status_time) AS status_time first(start_time) AS last_start_time first(eval(if(status="Completed", status_time, null))) AS last_completed by tsmserver,node,schedule | rename node AS NODE_NAME schedule AS SCHEDULE_NAME | fields tsmserver NODE_NAME SCHEDULE_NAME status status_time last_completed last_start_time] | eval first_sched=strptime(STARTDATE+STARTTIME, "%F%T") | `date_next(first_sched, DAYOFWEEK)` | eval period=relative_time(0, "+"+PERIOD+CASE(PERUNITS=="HOURS", "h", PERUNITS=="DAYS", "d", PERUNITS=="WEEKS", "w", PERUNITS=="MONTHS", "mon", PERUNITS=="YEARS", "y")) | eval next_run=now()+if(((now()-first_sched)+((now()-first_sched) % period)) % period = 0, ((now()-first_sched) % period), period-((now()-first_sched) % period)) | `date_next(next_run, DAYOFWEEK)` | `schedule_desc` | fields - first_sched period

[session_info]
definition = `lastdb("sessions")` | eval media_wait=coalesce(INPUT_MOUNT_WAIT, INPUT_VOL_WAIT, INPUT_VOL_ACCESS, OUTPUT_MOUNT_WAIT, OUTPUT_VOL_WAIT, OUTPUT_VOL_ACCESS) | eval pool=mvindex(split(media_wait, ","), 0) | eval volume=mvindex(split(media_wait, ","), 1) | eval mwait=mvindex(split(media_wait, ","), 2) | fillnull value="" volume | eval dur=" (" + tostring(WAIT_SECONDS, "duration") + "s)" | eval state=case(STATE=="Start", "Starting", STATE=="End", "Ending", STATE=="IdleW", "Waiting for client" + dur, STATE=="MediaW", "Waiting " + if(isnotnull(INPUT_MOUNT_WAIT) or isnotnull(OUTPUT_MOUNT_WAIT), "to mount ", if(isnotnull(INPUT_VOL_WAIT) or isnotnull(OUTPUT_VOL_WAIT), "for volume ", "")) + volume + " for " + if(isnotnull(INPUT_VOL_WAIT) or isnotnull(INPUT_MOUNT_WAIT), "reading", if(isnotnull(OUTPUT_VOL_WAIT) or isnotnull(OUTPUT_MOUNT_WAIT), "writing", "media")) + dur, STATE=="SendW", "Waiting to send data" + if(isnotnull(INPUT_VOL_ACCESS), " from " + volume, "") + dur, STATE=="RecvW", "Waiting to write data" + if(isnotnull(OUTPUT_VOL_ACCESS), " to " + volume, "") + dur, STATE=="Run", "Transfering" + if(isnotnull(INPUT_VOL_ACCESS), " to " + volume + " (" + tostring(mwait, "duration") + "s)", if(isnotnull(OUTPUT_VOL_ACCESS), " from " + volume + " (" + tostring(mwait, "duration") + "s)", "")) ) | eval volume=if(volume="", NULL, volume) | fields - media_wait dur
iseval = 0

[accounting_stats]
description = Calculate statistics on accounting data
definition = stats count as sessions count(eval(if(archive_in_files=0 AND archive_in_kb=0 AND archive_out_files=0 AND archive_out_kb=0 AND backup_in_files=0 AND backup_in_kb=0 AND backup_out_files=0 AND backup_out_kb=0, 1, null))) as nullsessions sum(archive_in_files) as archive_in_files sum(archive_in_kb) as archive_in_kb sum(archive_out_files) as archive_out_files sum(archive_out_kb) as archive_out_kb sum(backup_in_files) as backup_in_files sum(backup_in_kb) as backup_in_kb sum(backup_out_files) as backup_out_files sum(backup_out_kb) as backup_out_kb sum(comm_wait) as comm_wait sum(media_wait) as media_wait sum(idle_wait) as idle_wait sum(duration) as duration sum(total_kb) as total_kb by _time,tsmserver,node

[daily_accounting_stats_macro]
description = Calculate the daily accounting stats
definition = index="tsm-accnt" | bin _time span=1d | `accounting_stats`

[occupancy_stats]
description = Calculate statistics on occupancy data
definition = stats sum(LOGICAL_MB) AS logical_mb sum(PHYSICAL_MB) AS physical_mb sum(REPORTING_MB) AS reporting_mb sum(NUM_FILES) AS num_files by _time,tsmserver,node,type

[daily_occupancy_stats_macro]
definition = `tsmdb("occupancy")` | bin _time span=1d | stats latest(PHYSICAL_MB) AS PHYSICAL_MB latest(LOGICAL_MB) AS LOGICAL_MB latest(REPORTING_MB) AS REPORTING_MB latest(NUM_FILES) AS NUM_FILES latest(FILESPACE_NAME) AS FILESPACE_NAME by _time,tsmserver,NODE_NAME,STGPOOL_NAME,FILESPACE_ID,TYPE | rename NODE_NAME AS node TYPE AS type | `occupancy_stats` | lookup nodeinfo tsmserver NODE_NAME AS node OUTPUTNEW CONTACT USER_GROUP USER_SUBGROUP | `contact_deptgroup("CONTACT")`

[daily_occupancy_stats_time(1)]
args = time
definition = `lastdb_time("occupancy", "$time$")` | bin _time span=1d | stats latest(PHYSICAL_MB) AS PHYSICAL_MB latest(LOGICAL_MB) AS LOGICAL_MB latest(REPORTING_MB) AS REPORTING_MB latest(NUM_FILES) AS NUM_FILES latest(FILESPACE_NAME) AS FILESPACE_NAME by _time,tsmserver,NODE_NAME,STGPOOL_NAME,FILESPACE_ID,TYPE | rename NODE_NAME AS node TYPE AS type | `occupancy_stats` | lookup nodeinfo tsmserver NODE_NAME AS node OUTPUTNEW CONTACT | `contact_deptgroup("CONTACT")`

[client_support_status]
# http://www-01.ibm.com/support/docview.wss?uid=swg21053218
definition = eval s_VERSION=substr(VERSION, 0, 3) | eval s_SERVER_VERSION=substr(SERVER_VERSION, 0, 3) | eval SUPPORTED=if((s_SERVER_VERSION="8.1" OR s_SERVER_VERSION="7.1" OR s_SERVER_VERSION="6.3") AND (s_VERSION="8.1" OR s_VERSION="7.1" OR s_VERSION="6.4" OR s_VERSION="6.3"), "Supported", if(tonumber(s_SERVER_VERSION) < tonumber(s_VERSION), "Probably Supported", if(s_SERVER_VERSION="" OR s_VERSION="", "Unknown", "Not Supported")))