Answer
When using the reporting feature inside GFI EventsManager, it may be desirable to map multiple event fields to a single column.Example: An event id and its corresponding fields are different depending on OS the event was collected from.
Note: This example was done using logoff events 4634 (Vista/Longhorn) and 538(Pre-Vista). In this specific case two fields are used to identify the user logging off.
- Launch the GFI EventsManager 2012 Management Console
- Go to the Reporting tab
- Navigate to the desired report which you would like to map multiple fields to a single column
-
Right-click the report and select Properties
-
Select the Layout tab
- Add a custom column and define an appropriate column name (In this example Test Column Mapping is used however, User Name would be more appropriate since this is the data that will ultimately be in the column)
-
To map the event fields to this column select Add
- In Field Name type the exact name of the field used in the events. (In this example event id 4634 uses target user name and event id 538 uses user name to display the user account which triggered the event)
-
It is then necessary to create a condition to define when this event field should be used in the report. To do this, select Add in the Edit Restrictions section.
-
In this example user name is mapped to the column Test Column Mapping when the event id is equal to 538, and target user name is used when event id is equal to 4634
- Select OK on the Properties windows to apply the report settings
- Right-click the report and select Generate for the desired interval
-
This will output the results in the report as pictured below