Create Custom Log Summary Report Templates

On the main toolbar, click Report Center.
Click the Report Templates tab.
On the main toolbar, click New Report Template on the toolbar, and then click Log Summary.
The Log Detail Report Template Wizard appears.
Select a field from the lists for Groups 1, 2, and 3 to establish a data grouping hierarchy in a report. After you select an item from a group, the next lower Group field is enabled.

Items you select in a Group field are automatically removed from the Available Fields lists, except Normal Date which can be selected as both a group and field.

If you select Normal Date in any Group field, the Normal Date Grouping Mode field appears. Select an option or accept the default, Summarization By Day.

Normal Date Grouping Mode does not appear if you add Normal Date to the Selected Fields list.
Fields you add to the Selected Fields list become the report column headings. To move items between the Available Fields list and the Selected Fields list, do one of the following:
- Double-click an option. It moves to the other list.
- Select an option, then click the appropriate arrow between the lists to move it to the other list.
- To move multiple options at one time:
  - Select non-adjacent items by clicking each one while holding down the Ctrl key.
  - Select adjacent items by clicking the first and last one while holding down the Shift key or click an item and drag up or down while holding down the mouse button.
  After the items are selected, click the appropriate arrow to move them to the other list.

When space is restricted in report column headings, i and o may used as abbreviations for Impacted and Origin. For example, Hostname (Impacted) and Hostname (Origin) may appear as iHostname and oHostname.

There is a maximum number of Selected Fields allowed depending on the page layout you pick in a later window.

A landscape layout can have a maximum of eight fields. If you exceed eight, a warning message appears when you click Next. You must reduce the fields to eight or fewer to proceed.
A portrait layout can have a maximum of six fields. If you add seven or eight fields to the Selected Fields list, you may proceed, but portrait will not be an option on the Layout page.

The order of the items in the Selected Fields list determines the layout and sort order of the columns in the report template. The first item in the list is sorted first and is the first column. To change the order, select an item and click the Change Order arrows until you have the items positioned the way you want.

You can reposition the columns in the upcoming Wizard Layout window, but the sort order stays the way it appears in the Selected Fields list.
Check First Normal Date and/or Last Normal Date at the bottom of the window to add them as report columns after the Selected Fields and before any calculated fields.
Click Next.
The Select Calculated Fields and Summarization window appears.
(Optional) To add a calculated field to the report template, select one from the list, then select an operation and click Add.
The calculated field is added to the grid.
To delete a field after it is added, select it and click Remove.
To add additional calculated fields, repeat the previous steps.
By default, calculated fields become the last columns in the template in the order listed here. To reposition a calculated field, select it and click the appropriate Change Order arrow.

If the fields you add on this page plus the fields added on prior page exceed eight, a warning message appears when you click Next. You must reduce the total fields to eight or fewer to proceed. If the total fields equal seven or eight, the Layout page does not offer portrait as an option.
Click Next.
The Calculated Field Sorting window appears.
(Optional) To sort based on calculated fields, click the Enable Calculated Field Sorting box, and then select one of these options from the list and then proceed to one of the following options:
- All. Display and summarize all the data of the selected calculated field.
  When Sort Options = ALL
  1. Select an option from the Calculated Field drop-down list.
  2. Select a sort order. The default is ascending.
- Top N. Display the N highest values of the selected calculated field.
- Bottom N. Display the N lowest values of the selected calculated field.
  
  The window shows additional fields depending on your Sort Options selection.
  
  When Sort Options = Top N or Bottom N
  1. Select an option from the Calculated Fields drop-down list.
  2. In the Where N is field, select the number of highest (Top N) or lowest (Bottom N) values to display.
  3. If you want to include data that does not qualify as part of the highest or lowest values in the report template, check the Include Others box.
    Enter a group name for the non-qualifiers or accept the default name, Others.
Click Next.
On the Sorting page, select a sort order of Ascending or Descending for all the items in the template. The default is ascending.
Click Next.
On the Layout and Additional properties page, select a Layout Orientation.
Landscape is the default. Portrait is available if you have six or fewer fields selected for the template.
(Optional) To adjust column widths in the template, select a vertical column divider and drag it left or right.
(Optional) To return all column widths to their original sizes, click Reset.
(Optional) To change the display order of the columns, click and drag a column heading to a new location.

This does not change the sort order established in the Selected Fields list.
Type a name for the template.
(Optional) Enter a description for the template.
(Optional)If you want the template to be available for others to use, select the Public All Users check box.

Public templates can only be deleted by the creator and Global Administrators. Private templates can only be used and deleted by the creator.
Click OK.
You return to the LogRhythm Reporting Center with the new template listed.
Select the custom report template you want.
Right-click it and select New Report from Report Template.
Name and save the report when prompted.
Locate the report on the Reports tab and select the Action check box.
Right-click anywhere on the grid and select Run.
For more information on creating and running reports, see Create Reports.