Why am I only and always getting results from host in the network?

[null0]

hello guys,

This is my simple query for port flapping detection

    eventtype="cisco_ios-port_down" OR eventtype="cisco_ios-port_up" AND          

((host=10.29.18.*) OR (host=10.29.23.*)) OR ((host=10.29.72.*) OR (host=10.29.28.*)) OR ((host=10.11.40.*) OR (host=10.11.41.*) OR (host=10.11.42.*) OR (host=10.11.43.*) OR (host=10.11.44.*) OR (host=10.11.45.*) OR (host=10.11.46.*) OR (host=10.11.47.*) OR (host=10.11.2.*) OR (host=10.11.68.*) OR (host=10.11.2.*)) OR (host=10.29.56.*)      

    | rex field=host "10\.29\.56\.(?<range_10_29_56>\d{1,3})" 
    | where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)             

         | stats count,latest(port_status) AS port_status by host,src_interface | sort -count | table host,src_interface,port_status,count

Any hint about why i'm only and always getting results from host in 10.29.56.X network? i'm sure about the existence of entries for others networks.

many thanks

[493669 · Accepted solution]

You will always get result from from host in 10.29.56.X network due to where condition

| where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)

it will take only those which will satisfy above condition and other network host never contain field- range_10_29_56 so it will never be seen so try fillnull-

eventtype="cisco_ios-port_down" OR eventtype="cisco_ios-port_up" AND          
     ((host=10.29.18.*) OR (host=10.29.23.*)) OR ((host=10.29.72.*) OR (host=10.29.28.*)) OR ((host=10.11.40.*) OR (host=10.11.41.*) OR (host=10.11.42.*) OR (host=10.11.43.*) OR (host=10.11.44.*) OR (host=10.11.45.*) OR (host=10.11.46.*) OR (host=10.11.47.*) OR (host=10.11.2.*) OR (host=10.11.68.*) OR (host=10.11.2.*)) OR (host=10.29.56.*)
         | rex field=host "10\.29\.56\.(?<range_10_29_56>\d{1,3})" 
          |fillnull
         | where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)
          | stats count,latest(port_status) AS port_status by host,src_interface | sort -count | table host,src_interface,port_status,count

[null0]

seems that it works fine. i've never heard abt this cmd FILLNULL. many thx to all

[niketn]

@null0, following query seems to restrict the results to range 10.29.56.###

 | rex field=host "10\.29\.56\.(?<range_10_29_56>\d{1,3})" 
 | where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)