...
The difference between them is that the audit time is the time when the driver processes an event. If for some reason the driver loses connection to Opensearch, ACDI will store events in the cache. And the audit time in this case may significantly differ the from event time.
...
You want to use here “audittime.” For this entity, you need to use the entity index “main” as a source. The “Primary key” for the event attributes will be ‘Object DN” (object name) or any other you want to use in the report.
...
| Appanvil karma designer | ||||
|---|---|---|---|---|
|
This report is a simple one, so for now you don’t want to go for any secondary entities and mandatory attributes. Mandatory attribute is a way to filter objects that have at least one value of the selected attribute name.
...
Here you see that you will get only events that have at least one attribute value.
...
Now let's go back to the “Report properties” and select the main entity.
...
Done. The base for your report is ready. You can now save everything.
...
| Appanvil karma designer | ||||
|---|---|---|---|---|
|
It's time to define filters and result attributes you want to get in the final table. Let's go to “Filters” and add a few.
...
So, let’s assume you want a filter on the object name. The “ID of the Filter” will be “object_name.”
...
In this field, you need to select this entry from the selector. You will learn about the rest of the settings in the following video.
...
Here you use “keyword” as the source and the entry in the “Sort attribute” will be the same as in the “Attribute Name filter based on.”
...
Let’s save the settings.
...
Let's now check the “Result Table Attributes” and add some there.
...
Should you have any questions or require any assistance, please do not hesitate to contact us at any time swsupport.skypro@skypro.ch