Viewing a Transcript Search report

The Transcript Search report displays text that appears in device interaction transcripts based on the search criteria.

A transcript includes the complete conversation that took place between a device and the TrueSight Network Automation system when executing a span action from a job. A transcript shows the commands the TrueSight Network Automation system sent to the device and the responses the device sent back. It can include configuration data (when a snapshot was taken using tunneled mode) or configuration changes (when a Deploy to Active operation was done using tunneled mode). It can include various error messages that the device emitted when a command that the system sent was invalid or encountered a failure. A transcript contains a sequence of lines, and this report shows you the lines that match the search criteria.

Use this report when you want to determine if anyone made unauthorized security-related changes during interactive Telnet/SSH Sessions. Or, use this report when you recall seeing some sort of error from a device. but cannot recall where you saw it or what exactly happened.

To generate a Transcript Search report

1. Open the Transcript Search report wizard page by navigating to Reports > Search Reports > Transcript Search.
   

2. Enter the following information in the displayed fields:

   The [confluence_table-plus] macro is a standalone macro and it cannot be used inline. Click on this message for details.
   This macro generates standalone content. As a consequence you need to make sure to use a syntax that separates your macro from the content before and after it so that it's on a line by itself. For example in XWiki Syntax 2.0+ this means having 2 newline characters (a.k.a line breaks) separating your macro from the content before and after it.
   

3. Click Next to begin the report generation and New in 8.9.03to display its progress on the Report Activity page.
   

1. Click Refresh until the report is completed, or wait until you receive the notification email. If the report is aborted, the Progress column indicates so, to alert you that the report data is partial. You can view the partial report, but be aware it is partial. You should refine your selections (if you asked for too-large a report) or re-generate the report (if it was aborted due to a system shutdown) in order to obtain a complete report. Then delete the aborted report as soon as possible. For more information about the Report Activity page, see Viewing-report-activity.

2. Click the Transcript Search link in  the Report column to display the report.
   

   Verify the report is complete. If the report was aborted, the title and the Report Generation information in the footer inform you so, and the footer informs you about the user who aborted it. An aborted report will be missing one or more devices, actions, and jobs.

   The report contains the columns listed in the following table:

   The [confluence_table-plus] macro is a standalone macro and it cannot be used inline. Click on this message for details.
   This macro generates standalone content. As a consequence you need to make sure to use a syntax that separates your macro from the content before and after it so that it's on a line by itself. For example in XWiki Syntax 2.0+ this means having 2 newline characters (a.k.a line breaks) separating your macro from the content before and after it.The following figure shows a sample Transcript Search Details report.
   

3. (Optional) Perform one of the following tasks by using the menu options that are available on the Transcript Search report page:

   Menu option	Description
   Back (Applicable for 8.9.02 and earlier versions) Refine (Applicable for 8.9.03 and later versions)	Return to the wizard to change report parameters and generate a new version of the report.
   Print View	Print a copy of the report.
   Export	Export the report to one of the following formats: HTML PDF RTF
   Email	Email the report to one or more recipients in one of the export formats.
   Help	Display Help.