Report Templates

A report template is the analysis definition: SQL that fills an in-memory database, plus the text or HTML written to the output file.

Templates are stored in syslog storage. The product install can also ship read-only templates (shown as Installation).

Report Templates Window

On the Messages toolbar, click Reports → Manage Report Templates…​.

The list is grouped by From (Installation or Syslog Storage). Columns: Name and Description.

Without permission to change templates, the window is Read Only (Edit…​ becomes View…​).

Add a Template

  1. Click Create New.

  2. Fill Report Template properties.

  3. Click Create.

Name is required and must be unique in storage.

Duplicate a Template

Select a row (storage or Installation) → Duplicate. The editor opens with a copy. Create writes a new storage template.

Edit a Template

Select a storage row → Edit…​. An Installation template opens read-only; duplicate it to change a copy.

Delete a Template

Select a storage row → Delete → confirm. Installation templates cannot be deleted.

Report Template

General Properties

Setting Description

Name

Required unique name. Shown on generate/schedule requests and on the Scheduled Reports list.

Description

Optional comment.

Data Fields (Optional)

Leave it collapsed unless per-message SQL or a command Execute for filter needs extra fields from the message body.

Extracted names are available as {FIELD} in command SQL and filters. See Field Extraction.

Collecting Data

Initialization (SQL commands)

Runs once before any message. Create tables, indexes, and seed rows here.

Time fields replaced before execution:

  • {FROM} / {TO} — start and end of the message range (optional date/time modifier after |; without a modifier the value is ISO local date and time)

  • {SAMPLING_INTERVAL} — SQLite time step the engine chose for the range (+1 day, +01:00:00, +00:01:00, or +00:00:01)

Example:

CREATE TABLE Counters (Name TEXT PRIMARY KEY, Value INTEGER);
INSERT INTO Counters (Name, Value) VALUES ('Keyword1', 0);

For Each Message

Click Add Commands for each SQL statement that should run on matching messages.

Setting Description

SQL Commands

SQL run when the message passes Execute for. May include message fields. Use EscSQL on values taken from syslog text.

Execute for

Optional expression. Blank = all messages that already passed the request filter.

{SAMPLED_TIMESTAMP} in the SQL is replaced with a {RECEIVED} format at the sampling grain for the range.

Finalization (SQL commands)

Runs once after every message. Consolidate rows and prepare tables for output.

Replaced fields: {FROM}, {TO}, {GENERATED}, {N} (messages that passed the request filter), {BYTES} (sum of raw message lengths), {SAMPLING_INTERVAL}.

Output File

Filename template

Name of the file to write. {GENERATED} is the generation timestamp (optional | date/time modifier).

Example: Counters-{GENERATED|%Y-%m-%dT%H-%M-%S}.html

Characters that are illegal in Windows file names are replaced. Generate Now asks for the folder. Scheduled reports use the server Output folder.

Report file contents

Text or HTML written after finalization.

Replaced fields: {FROM}, {TO}, {GENERATED}, {N}, {BYTES}, {SAMPLING_INTERVAL}.

Query the in-memory database:

{{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword1';}}
  {0}
{{END}}

{0}, {1}, … are result columns (0-based). The engine HTML-escapes those values. The inner chunk is repeated for each result row.

Include an external file (searched in the install ReportResources folder, and for scheduled reports also in Include folders):

{{INCLUDE header.html}}

Related Topics