Create Custom Log Detail Report Templates

On the main toolbar, click Report Center.
Click the Report Templates tab.
On the main toolbar, click New Report Template on the toolbar, and then click Log Detail.
The Log Detail Report Template Wizard appears.
Select a field from the lists for Groups 1, 2, and 3 to establish a data grouping hierarchy in a report. After you select an item from a group, the next lower Group field is enabled.

Items you select in a Group field are automatically removed from the Available Fields lists, except Normal Date which can be selected as both a group and field.

If you select Normal Date in any Group field, the Normal Date Grouping Mode field appears. Select an option or accept the default, Summarization By Day.

Normal Date Grouping Mode does not appear if you add Normal Date to the Selected Fields list.
Fields you add to the Selected Fields list become the report column headings. To move items between the Available Fields list and the Selected Fields list, do one of the following:
- Double-click an option. It moves to the other list.
- Select an option, then click the appropriate arrow between the lists to move it to the other list.
- To move multiple options at one time:
  - Select non-adjacent items by clicking each one while holding down the Ctrl key.
  - Select adjacent items by clicking the first and last one while holding down the Shift key or click an item and drag up or down while holding down the mouse button.
  After the items are selected, click the appropriate arrow to move them to the other list.

When space is restricted in report column headings, i and o may used as abbreviations for Impacted and Origin. For example, Hostname (Impacted) and Hostname (Origin) may appear as iHostname and oHostname.

There is a maximum number of Selected Fields allowed depending on the page layout you pick in a later window.

A landscape layout can have a maximum of eight fields. If you exceed eight, a warning message appears when you click Next. You must reduce the fields to eight or fewer to proceed.
A portrait layout can have a maximum of six fields. If you add seven or eight fields to the Selected Fields list, you may proceed, but portrait will not be an option on the Layout page.

The order of the items in the Selected Fields list determines the layout and sort order of the columns in the report template. The first item in the list is sorted first and is the first column. To change the order, select an item and click the Change Order arrows until you have the items positioned the way you want.

You can reposition the columns in the upcoming Wizard Layout window, but the sort order stays the way it appears in the Selected Fields list.
Click Next.
On the Sorting page, select Ascending or Descending sort order for each Group and Field item in the template. The default is ascending.
Click Next.
On the Layout and Additional properties page, select a Layout Orientation.
Landscape is the default. Portrait is available if you have six or fewer fields selected for the template.
(Optional) To adjust column widths in the template, select a vertical column divider and drag it left or right.
(Optional) To return all column widths to their original sizes, click Reset.
(Optional) To change the display order of the columns, click and drag a column heading to a new location.

This does not change the sort order established in the Selected Fields list.
Type a name for the template.
(Optional) Enter a description for the template.
(Optional)If you want the template to be available for others to use, select the Public All Users check box.

Public templates can only be deleted by the creator and Global Administrators. Private templates can only be used and deleted by the creator.
Click OK.
You return to the LogRhythm Reporting Center with the new template listed.
Select the custom report template you want.
Right-click it and select New Report from Report Template.
Name and save the report when prompted.
Locate the report on the Reports tab and select the Action check box.
Right-click anywhere on the grid and select Run.
For more information on creating and running reports, see Create Reports.