We are delighted to share our new EIC Delivery Methodology for efficiently managing Saviynt Implementations and delivering quick time to value. CLICK HERE.

Saviynt Analytics Queries

venkateshkandim
New Contributor
New Contributor

Hi,

We are trying to integrate Saviynt with Splunk and looking for queries for the following scenarios

  • No of Jobs failed in a day - This could be aggregation jobs or provisioning errors
  • No of HR Events in a day - This is to identify how many joiners/terminations are processed in a day
  • No of SysLog errors generated in a day - Errors that are logged to syslog, these could range from generic login errors, code snippet errors or connection timeouts etc

It would be a great help if I could the queries or the tables that I need to look at to build these queries.

Thanks,

VK.

2 REPLIES 2

Rishi
Saviynt Employee
Saviynt Employee

I believe that you are designing a solution to consume Saviynt data into Splunk by invoking Saviynt Analytics via API calls. 

For the first bullets (HR events and task failures), please refer the following documentation which provides the table schema information.  You can use Data Analyzer option to create queries and test - if you get desirable results then can use that query to create the run time analytics. Once the run time analytics is created, you can use Saviynt analytics fetchRuntimeControlsData (or fetchRuntimeControlsDataV2 based Saviynt version) to get Saviynt Analytics data. 

https://docs.saviyntcloud.com/bundle/SSM-DB-Schema-Reference-v55x/page/Content/Identity-Repository-S...

Regarding the third bullet - the system logs or application logs are Not stored in database, so there is no Analytics that can fetch log level information.

rushikeshvartak
All-Star
All-Star
  • No of Jobs failed in a day - select i.jobid,i.filename,i.LOGDATAASXML,e.JOBSTARTDATE,e.JOBENDDATE,e.SYSTEMNAME,e.EXTERNALCONNECTION,e.jobname,e.SAVRESPONSE from importlog i,ecmimportjob e where e.jobid =i.jobid and (e.jobstartdate > sysdate() - INTERVAL 1 DAY) and SAVRESPONSE not in ('SUCCESS')

 

  • No of HR Events in a day 

Teminated : SELECT USERNAME, FIRSTNAME, LASTNAME, EMAIL, OWNER, CASE STATUSKEY WHEN '0' THEN 'INACTIVE' WHEN '1' THEN 'ACTIVE' END AS USERSTATUS, UPDATEDATE as Updateddate, DEPARTMENTname as 'DEPARTMENT' FROM USERS WHERE UPDATEDATE > DATE_SUB(CURDATE(), INTERVAL 30 DAY) AND STATUSKEY = 0;

New : SELECT USERNAME, FIRSTNAME, LASTNAME, EMAIL, OWNER, CREATEDATE, CASE STATUSKEY WHEN '0' THEN 'INACTIVE' WHEN '1' THEN 'ACTIVE' END AS USERSTATUS, U.DEPARTMENTname as 'DEPARTMENT' FROM USERS U WHERE CREATEDATE > DATE_SUB(CURDATE(), INTERVAL 30 DAY) AND U.STATUSKEY = 1;

  • No of SysLog errors generated in a day - Not stored in DB

 


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.