Issues Query Filtering about splunk-apps

[wastorga]

Hi @phphasuk

Yes, the file to change would be input_module_cisco_dnac_issue.py, function get_issues. You would need to rewrite the if issue_id: ... code, the API call is done by function dnac.issues.get_issue_enrichment_details

There are some fields that the issue_item (item of the general get has):

issue_info[issue_id].update(
    {
        "IssueName": issue_item.get("name") or "",
        "IssueDeviceRole": issue_item.get("deviceRole") or "",
        "IssueAiDriven": issue_item.get("aiDriven") or "",
        "IssueClientMac": issue_item.get("clientMac") or "",
        "IssueCount": issue_item.get("issue_occurence_count") or "",
        "IssueStatus": issue_item.get("status") or "",
        "IssuePriority": issue_item.get("priority") or "",
        "IssueCategory": issue_item.get("category") or "",
    }
)

and others that are currently obtained using the enrichment details (see simplify_issue code)

1. IssueID
2. IssueSpecificCategory
3. IssueSpecificSource
4. IssueSpecificName
5. IssueSpecificEntity
6. IssueSpecificSeverity
7. IssueSpecificPriority
8. IssueSpecificSummary
9. IssueSpecificTimestamp
10. IssueSpecificDescription
11. IssueSpecificEntityValue

Note: Some of these fields are required for the dashboard of the Cisco DNA Center App for Splunk, search the field on the Splunk_CiscoDNACenter folder.

[phphasuk]

Hi @wastorga ,
Thank you so much for your suggestion. I will test it.

[wastorga]

Hi @phphasuk,
Can I help you with anything else?

If everything went well, feel free to close the ticket.
If no response is given, I will close due to inactivity on September 2nd.

[phphasuk]

Hi @wastorga ,

I think, We can close this case. Thank you so much for your suggestion.

[wastorga]

Hi @phphasuk

Great, glad I was able to help.