#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["150","151"])
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
|sum(Vendor.TransferredGb, as=_totalTransferredGb)

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["190","290","790","194","490","390","36022","36026"])
| in(field=host.name, values=[?hostname])
| Vendor.JobResultCode = *
| Vendor.JobTypeCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="40700"
| in(field=host.name, values=[?hostname])
| rename(field=Vendor.State, as=State)
| rename(field=host.name, as="Data Source")
| rename(field=Vendor.FullUserName, as=User)
|table([@timestamp, "Data Source", User, State])

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["190","40290","790","194","490","390","36022","36026"])
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| match(file="veeam/veeamdataplatform/job_types_lookup.csv", column=JobType, field=Vendor.JobTypeCode, strict=false)
| default(field=JobTypeDescription, value="Unknown Type")
| rename(field=JobResultMessage, as=State)
| rename(field=host.name, as="Data Source")
| rename(field=message, as="Message Details")
| rename(field=JobTypeDescription, as="Job Type")
| table([@timestamp, "Data Source", "Message Details", "Job Type", State])

#Vendor="veeam"
| #event.module="vbr"
| event.id="592"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="198"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="190"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = "13000"
| Vendor.SourceType = "3"
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="610"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="490"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = "13003"
| Vendor.SourceType = "5"
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="190"
| Vendor.JobTypeCode = "13000"
| Vendor.SourceType = "8"
| in(field=host.name, values=[?hostname])
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="36022"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="390"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| timeChart(series=JobResultMessage, span="1 day")

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["190","790","194","490","36022","36026"])
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| timeChart(series=JobResultMessage, span="1 day")

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["150", "450"])
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| in(field=Vendor.JobResultCode, values=["2","3"])
| match(file="veeam/veeamdataplatform/session_states_lookup.csv", column=ResultCode, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy([Vendor.VmName, JobResultMessage])
| sort(field=[JobResultMessage, _count], limit=15, order=[asc, desc])

#Vendor="veeam"
| #event.module="vbr"
| event.id="200"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="190"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = "78"
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="190"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = "13000"
| Vendor.SourceType = "7"
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="590"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["190","790","194","490","390","36022","36026"])
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/job_types_lookup.csv", column=JobType, field=Vendor.JobTypeCode, strict=false)
| default(field=JobTypeDescription, value="Unknown Type")
| timeChart(series=JobTypeDescription, span="1 day")

#Vendor="veeam"
| #event.module="vbr"
| event.id="36026"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="790"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="194"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["40290", "40800"])
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| match(file="veeam/veeamdataplatform/job_types_lookup.csv", column=JobType, field=Vendor.JobTypeCode, strict=false)
| default(field=JobTypeDescription, value="Unknown Type")
| timeChart(series=JobTypeDescription, span="1 day")

#Vendor="veeam"
| #event.module="vbr"
| event.id="490"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["151", "451"])
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = *
| in(field=Vendor.JobResultCode, values=["2","3"])
| match(file="veeam/veeamdataplatform/session_states_lookup.csv", column=ResultCode, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy([Vendor.SourceName, JobResultMessage])
| sort(field=[JobResultMessage, _count], limit=15, order=[asc, desc])

#Vendor="veeam"
| #event.module="vbr"
| event.id="190"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = "1"
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| event.id="190"
| in(field=host.name, values=[?hostname])
| Vendor.JobTypeCode = "0"
| Vendor.JobResultCode = *
| match(file="veeam/veeamdataplatform/action_results_lookup.csv", column=JobResult, field=Vendor.JobResultCode, strict=false)
| default(field=JobResultMessage, value="Unknown State")
| groupBy(field=JobResultMessage)

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42500","27000","24060","24030","24050","24070","24040","42290","23630","23631","23632","23633","24020","24114","24131","24140","24142","24143","24160","24170","25000","25210","25220","25400","25700","25800","26000","26600","26700","26800","26900","27200","27300","27500","27600","27900","28400","28800","28850","28940","29110","29140","30700","30800","31000","32100","32400","32800","40202","41200","41401","42280"])
| in(field=host.name, values=[?hostname])
| groupBy(Vendor.Severity)

#Vendor="veeam"
| #event.module="vbr"
| event.id="42402"
| in(field=host.name, values=[?hostname])
| Vendor.OperationId = *
| match(file="veeam/veeamdataplatform/operation_names_lookup.csv", column="Operation Id", field=Vendor.OperationId, strict=false)
| default(field=OperationName, value="Unknown Operation")
| timeChart(series=OperationName, span="1 day")

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42500","27000","24060","24030","24050","24070","24040","42290","23630","23631","23632","23633","24020","24114","24131","24140","24142","24143","24160","24170","25000","25210","25220","25400","25700","25800","26000","26600","26700","26800","26900","27200","27300","27500","27600","27900","28400","28800","28850","28940","29110","29140","30700","30800","31000","32100","32400","32800","40202","41200","41401","42280"])
| in(field=host.name, values=[?hostname])
| match(file="veeam/veeamdataplatform/vbr_events_lookup.csv", column="Event Id", field=event.id)
| groupBy(field="Event Name")

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42500","27000","24060","24030","24050","24070","24040","42290","23630","23631","23632","23633","24020","24114","24131","24140","24142","24143","24160","24170","25000","25210","25220","25400","25700","25800","26000","26600","26700","26800","26900","27200","27300","27500","27600","27900","28400","28800","28850","28940","29110","29140","30700","30800","31000","32100","32400","32800","40202","41200","41401","42280"])
| in(field=host.name, values=[?hostname])
| match(file="veeam/veeamdataplatform/vbr_events_lookup.csv", column="Event Id", field=event.id)
| timeChart(series=Severity, span="1 day")

#Vendor="veeam"
| #event.module="veeamone"
| in(field=event.id, values=["395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378"])
| in(field=host.name, values=[?vonehostname])
| rename(field="host.name", as="Data Source")
| rename(field=Vendor.Severity, as=Severity)
| rename(field=message, as="Message Details")
| rename(field=Vendor.alarm_name, as="Alarm Name")
| rename(field=Vendor.alarm_type, as="Alarm Type")
| rename(field=Vendor.status_old, as="Previous Status")
| rename(field=Vendor.status_new, as="Current Status")
| rename(field=Vendor.object_name, as="Object Name")
| rename(field=Vendor.object_path, as="Object Path")
| table([@timestamp, "Data Source", "Alarm Name", Severity, "Alarm Type", "Message Details", "Previous Status", "Current Status", "Object Name", "Object Path"])

#Vendor="veeam"
| in(field=event.id, values=["41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42500","27000","24060","24030","24050","24070","24040","42290","23630","23631","23632","23633","24020","24114","24131","24140","24142","24143","24160","24170","25000","25210","25220","25400","25700","25800","26000","26600","26700","26800","26900","27200","27300","27500","27600","27900","28400","28800","28850","28940","29110","29140","30700","30800","31000","32100","32400","32800","40202","41200","41401","42280","395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344","378"])
| in(field=host.name, values=[?hostname, ?vonehostname])
| count()

#Vendor="veeam"
| #event.module="vbr"
| in(field=event.id, values=["41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42500","27000","24060","24030","24050","24070","24040","42290","23630","23631","23632","23633","24020","24114","24131","24140","24142","24143","24160","24170","25000","25210","25220","25400","25700","25800","26000","26600","26700","26800","26900","27200","27300","27500","27600","27900","28400","28800","28850","28940","29110","29140","30700","30800","31000","32100","32400","32800","40202","41200","41401","42280"])
| in(field=host.name, values=[?hostname])
| match(file="veeam/veeamdataplatform/vbr_events_lookup.csv", column="Event Id", field=event.id)
| rename(field=message, as="Message Details")
| rename(field=host.name, as="Data Source")
| rename(field=Vendor.FullUserName, as=User)
| table([@timestamp, "Data Source", User, "Message Details", Severity])

#Vendor="veeam"
| #event.module="veeamone"
| in(field=event.id, values=["395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378"])
| in(field=host.name, values=[?vonehostname])
| timeChart(series=Vendor.Severity, span="1 day")

#Vendor="veeam"
| #event.module="vbr"
| event.id="42220"
| in(field=host.name, values=[?hostname])
| count()

#Vendor="veeam"
| #event.module="veeamone"
| in(field=event.id, values=["395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378"])
| in(field=host.name, values=[?vonehostname])
| groupBy(field=Vendor.alarm_name)

#Vendor="veeam"
| #event.module="veeamone"
| in(field=event.id, values=["395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378"])
| in(field=host.name, values=[?vonehostname])
| groupBy(field=Vendor.Severity)

#Vendor="veeam"
| #event.module="vbr"
| event.id="41600"
| in(field=host.name, values=[?hostname])
| count()

#Vendor="veeam"
| #event.module="vbr"
| event.id="42402"
| in(field=host.name, values=[?hostname])
| count()