topic Network Toolkit: How to ping hosts from a search in Splunk Search

Network Toolkit: How to ping hosts from a search

rohitmaheshwari — Wed, 14 Aug 2019 20:25:06 GMT

I have a search that gives me a column with hostnames

host
A
B
C

I am trying to use the network toolkit application from Splunk base to ping these hosts to see if they are still alive.

for example
if I have search such as this:

index=abc | stats values(host) as host | mvexpand host

How can I add another column using the |ping command or any other command to see if I am able to receive a status on these servers?

Re: Network Toolkit: How to ping hosts from a search

Sukisen1981 — Thu, 15 Aug 2019 07:45:52 GMT

hi @rohitmaheshwari
you need to use the map command, The ping command in this app which gives info like dest,sent , packet loss etc are all based on the host field , which is a ip address.
Try this in your network toolkit app

index=abc | stats values(host) as host | mvexpand host | map search="| ping host=$host$  count=1 |  eval dest=if(isnull(dest),host,dest) | fields dest sent received packet_loss min_ping avg_ping max_ping jitter | eval row="Value" | transpose column_name=Data header_field=row"

NOTE : The command /app itself is a bit slow, strongly suggest to limit initial host set to only 3 ips at first
See the output and then decide how to proceed further, all I am doing above is passing each host value from your index into the ping command, it works like a for loop.

Re: Network Toolkit: How to ping hosts from a search

Sukisen1981 — Mon, 19 Aug 2019 14:58:58 GMT

hi @rohitmaheshwari
Please try out and accept the answer if this works for you

Re: Network Toolkit: How to ping hosts from a search

lamelendrez — Tue, 31 Jan 2023 22:03:06 GMT

How could I do a incorporate an inputlookup to the search to change the IP address to a device name?