All Veeam triggered alarms for the last 7 days

Provides an overview of Veeam ONE alarms triggered for the last 7 days.

Details

ID	`e32e26a18441477599887e9e96068a11`
Time Frame	Last 7d
Supported Modules	xsiam

Widgets (3)

Veeam ONE Alarms

The total amount of Veeam ONE alarms.

Custom XQL pie

dataset in (veeam_*) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "predefined_alarm_id\=\"(\d+)\""),0)
| filter _instanceId in ("395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378")
| alter
    _host=arrayindex(regextract(_raw_log , "<\d+>\d\s+\S+\s+(\S+)\s"), 0),
    _description=arrayindex(regextract(_raw_log, "alarm_details\=\"([^\"]*)(?:\"|$)"),0),
    _alarmName=arrayindex(regextract(_raw_log, "alarm_name\=\"([^\"]*)(?:\"|$)"),0),
    _alarmType=arrayindex(regextract(_raw_log, "alarm_type\=\"([^\"]*)(?:\"|$)"),0),
    _objectName=arrayindex(regextract(_raw_log, "object_name\=\"([^\"]*)(?:\"|$)"),0),
    _statusNew=arrayindex(regextract(_raw_log, "status_new\=\"([^\"]*)(?:\"|$)"),0),
    _statusOld=arrayindex(regextract(_raw_log, "status_old\=\"([^\"]*)(?:\"|$)"),0),
    _objectPath=arrayindex(regextract(_raw_log, "object_path\=\"([^\"]*)(?:\"|$)"),0)
| filter _host in ($one_hosts)
| alter  _severity=if(
        _instanceId in ("364","391","365","370","314","331","403","342","315","332","344"), "Critical", 
        _instanceId in ("395","369","376","377","316","381","378"), "Medium")
| comp count(_instanceId ) as _count by _severity




| view graph type = pie subtype = full xaxis = _severity yaxis = _count valuecolor("Critical","#D10000") valuecolor("High","#FF8F2E") valuecolor("Medium","#0084D1") valuecolor("Information","#00D15F")

Veeam One Alarms by Name

The breakdown of Veeam ONE alarms by name.

Custom XQL pie

dataset in (veeam_*) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "predefined_alarm_id\=\"(\d+)\""),0)
| filter _instanceId in ("395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378")
| alter
    _host=arrayindex(regextract(_raw_log , "<\d+>\d\s+\S+\s+(\S+)\s"), 0),
    _description=arrayindex(regextract(_raw_log, "alarm_details\=\"([^\"]*)(?:\"|$)"),0),
    _alarmName=arrayindex(regextract(_raw_log, "alarm_name\=\"([^\"]*)(?:\"|$)"),0),
    _alarmType=arrayindex(regextract(_raw_log, "alarm_type\=\"([^\"]*)(?:\"|$)"),0),
    _objectName=arrayindex(regextract(_raw_log, "object_name\=\"([^\"]*)(?:\"|$)"),0),
    _statusNew=arrayindex(regextract(_raw_log, "status_new\=\"([^\"]*)(?:\"|$)"),0),
    _statusOld=arrayindex(regextract(_raw_log, "status_old\=\"([^\"]*)(?:\"|$)"),0),
    _objectPath=arrayindex(regextract(_raw_log, "object_path\=\"([^\"]*)(?:\"|$)"),0)
| filter _host in ($one_hosts)
| comp count(_instanceId ) as _count by _alarmName








| view graph type = pie subtype = full xaxis = _alarmName yaxis = _count

Latest Triggered Alarms

Custom XQL table

 dataset in (veeam_*) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "predefined_alarm_id\=\"(\d+)\""),0),
    _day=date_floor(_time ,"d")
| filter _instanceId in ("395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=arrayindex(regextract(_raw_log , "(?:\d+:\d+:\d+\s+|\d+-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[\+\-]\d{2}:\d{2}\s)(\S+)\s"), 0),
    _description=arrayindex(regextract(_raw_log, "alarm_details\=\"([^\"]*)(?:\"|$)"),0),
    _alarmName=arrayindex(regextract(_raw_log, "alarm_name\=\"([^\"]*)(?:\"|$)"),0),
    _alarmType=arrayindex(regextract(_raw_log, "alarm_type\=\"([^\"]*)(?:\"|$)"),0),
    _objectName=arrayindex(regextract(_raw_log, "object_name\=\"([^\"]*)(?:\"|$)"),0),
    _statusNew=arrayindex(regextract(_raw_log, "status_new\=\"([^\"]*)(?:\"|$)"),0),
    _statusOld=arrayindex(regextract(_raw_log, "status_old\=\"([^\"]*)(?:\"|$)"),0),
    _objectPath=arrayindex(regextract(_raw_log, "object_path\=\"([^\"]*)(?:\"|$)"),0)
| alter  _severity=if(
        _instanceId in ("364","391","365","370","314","331","403","342","315","332","344"), "Critical", 
        _instanceId in ("395","369","376","377","316","381","378"), "Medium")
| sort desc _time
| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description  as `Message Details`, _statusOld  as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`

Source

Veeam_All_Veeam_triggered_alarms_for_the_last_7_days.json

Download History Raw

{
  "templates_data": [
    {
      "id": "e32e26a18441477599887e9e96068a11",
      "name": "All Veeam triggered alarms for the last 7 days",
      "report_name": "All Veeam triggered alarms for the last 7 days",
      "report_description": "Provides an overview of Veeam ONE alarms triggered for the last 7 days.",
      "layout": [
        {
          "id": "Row 1",
          "data": [
            {
              "key": "header",
              "data": {
                "name": "All triggered alarms for the last 7 days",
                "type": "",
                "width": 100,
                "height": 140,
                "tenantId": "2209138820274",
                "description": "Provides an overview of Veeam ONE alarms triggered for the last 7 days.",
                "customerName": "Veeam Software Corporation (Tech Partner Only)"
              }
            }
          ]
        },
        {
          "id": "row-4068",
          "data": [
            {
              "key": "xql_1719488295523",
              "data": {
                "type": "Custom XQL",
                "width": 50,
                "height": 400,
                "params": [
                  {
                    "name": "one_hosts",
                    "value": "*"
                  }
                ],
                "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n    _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n    _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter  _severity=if(\r\n        _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n        _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp count(_instanceId ) as _count by _severity\r\n\r\n\r\n\r\n\r\n| view graph type = pie subtype = full xaxis = _severity yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ",
                "time_frame": {
                  "relativeTime": 604800000
                },
                "viewOptions": {
                  "type": "pie",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "full"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "xaxis",
                        "value": "_severity"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "_count"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "\"Critical\"",
                          "\"#D10000\""
                        ],
                        "name": "valuecolor"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "\"High\"",
                          "\"#FF8F2E\""
                        ],
                        "name": "valuecolor"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "\"Medium\"",
                          "\"#0084D1\""
                        ],
                        "name": "valuecolor"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "\"Information\"",
                          "\"#00D15F\""
                        ],
                        "name": "valuecolor"
                      }
                    }
                  ]
                }
              }
            },
            {
              "key": "xql_1719493861066",
              "data": {
                "type": "Custom XQL",
                "width": 50,
                "height": 400,
                "params": [
                  {
                    "name": "one_hosts",
                    "value": "*"
                  }
                ],
                "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n    _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n    _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| comp count(_instanceId ) as _count by _alarmName\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _alarmName yaxis = _count ",
                "time_frame": {
                  "relativeTime": 604800000
                },
                "viewOptions": {
                  "type": "pie",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "full"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "xaxis",
                        "value": "_alarmName"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "_count"
                      }
                    }
                  ]
                }
              }
            }
          ]
        },
        {
          "id": "row-209",
          "data": [
            {
              "key": "xql",
              "data": {
                "type": "Custom XQL",
                "title": "Latest Triggered Alarms",
                "width": 100,
                "height": 844,
                "phrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0),\r\n    _day=date_floor(_time ,\"d\")\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n    _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n    _host=arrayindex(regextract(_raw_log , \"(?:\\d+:\\d+:\\d+\\s+|\\d+-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d+[\\+\\-]\\d{2}:\\d{2}\\s)(\\S+)\\s\"), 0),\r\n    _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter  _severity=if(\r\n        _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n        _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description  as `Message Details`, _statusOld  as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`",
                "time_frame": {
                  "relativeTime": 604800000
                },
                "viewOptions": {
                  "type": "table",
                  "commands": []
                }
              }
            }
          ]
        }
      ],
      "default_template_id": 1,
      "time_frame": {
        "relativeTime": 604800000
      },
      "global_id": "e32e26a18441477599887e9e96068a11",
      "time_offset": 10800,
      "metadata": "{\"params\": []}"
    }
  ],
  "widgets_data": [
    {
      "widget_key": "xql_1719488295523",
      "title": "Veeam ONE Alarms",
      "creation_time": 1727085304948,
      "description": "The total amount of Veeam ONE alarms.",
      "data": {
        "params": [
          {
            "name": "one_hosts",
            "value": "*"
          }
        ],
        "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n    _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n    _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter  _severity=if(\r\n        _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n        _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp count(_instanceId ) as _count by _severity\r\n\r\n\r\n\r\n\r\n| view graph type = pie subtype = full xaxis = _severity yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ",
        "time_frame": {
          "relativeTime": 2592000000
        },
        "viewOptions": {
          "type": "pie",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "subtype",
                "value": "full"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "xaxis",
                "value": "_severity"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "_count"
              }
            },
            {
              "func": {
                "args": [
                  "\"Critical\"",
                  "\"#D10000\""
                ],
                "name": "valuecolor"
              }
            },
            {
              "func": {
                "args": [
                  "\"High\"",
                  "\"#FF8F2E\""
                ],
                "name": "valuecolor"
              }
            },
            {
              "func": {
                "args": [
                  "\"Medium\"",
                  "\"#0084D1\""
                ],
                "name": "valuecolor"
              }
            },
            {
              "func": {
                "args": [
                  "\"Information\"",
                  "\"#00D15F\""
                ],
                "name": "valuecolor"
              }
            }
          ]
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [
          "veeam_*"
        ],
        "query_uses_library": false
      }
    },
    {
      "widget_key": "xql_1719493861066",
      "title": "Veeam One Alarms by Name",
      "creation_time": 1727085305148,
      "description": "The breakdown of Veeam ONE alarms by name.",
      "data": {
        "params": [
          {
            "name": "one_hosts",
            "value": "*"
          }
        ],
        "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n    _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n    _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| comp count(_instanceId ) as _count by _alarmName\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _alarmName yaxis = _count ",
        "time_frame": {
          "relativeTime": 86400000
        },
        "viewOptions": {
          "type": "pie",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "subtype",
                "value": "full"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "xaxis",
                "value": "_alarmName"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "_count"
              }
            }
          ]
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [
          "veeam_*"
        ],
        "query_uses_library": false
      }
    }
  ],
  "supportedModules": [
    "xsiam"
  ]
}