Splunk Search

Network topology

Zhanali
Path Finder

Hi everyone!
Maybe someone faced such a problem:

I want to build a Layer 2 network topology, I have enough data for this. I am working with the Network Diagram Viz app. And I have a table of links, something like this:

from
tolocal_intremote_intlinkcolortypelinktextvalue
AIC-switch-2960.aic.kzSW9300test.aic.kzGi0/1Gi1/0/23greendeployment-serverGi0/1 to Gi1/0/23AIC-switch-2960.aic.kz
SW9300test.aic.kzAIC-switch-2960.aic.kzGi1/0/23Gi0/1greendeployment-serverGi1/0/23 to Gi0/1SW9300test.aic.kz
SW9300test.aic.kzSW3850test.aic.kzGi1/0/9Gi1/0/9 greendeployment-serverGi1/0/9 to Gi1/0/9SW9300test.aic.kz
SW9300test.aic.kzSW3850test.aic.kzGi1/0/10Gi1/0/10 greendeployment-serverGi1/0/10 to Gi1/0/10SW9300test.aic.kz
SW3850test.aic.kzSW9300test.aic.kzGi1/0/9Gi1/0/9 greendeployment-serverGi1/0/9 to Gi1/0/9SW3850test.aic.kz
SW3850test.aic.kzSW9300test.aic.kzGi1/0/10Gi1/0/10 greendeployment-serverGi1/0/10 to Gi1/0/10SW3850test.aic.kz
AIC-switch-2960.aic.kzSIP-W60BGi0/12WAN PORTgreenphone-squareGi0/12 to WAN PORTAIC-switch-2960.aic.kz

 

And, accordingly, in the topology, this is:

Zhanali_0-1627359025132.png

 

I took information about connected devices from AIC-switch-2960.aic.kz, SW9300test.aic.kz and SW3850test.aic.kz.

I just need to remove non-redundant links from the table. What solution can you advise to delete such entries automatically or some other way?

Thanks!

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Zhanali,

Please try adding below spl to the end of your search, it will dedup redundant links.

| eval ftlink=if(local_int>remote_int,local_int.remote_int,remote_int.local_int) 
| eval ft=if(from>to,from.to.ftlink,to.from.ftlink) 
| dedup ft 
| fields - ft
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Zhanali,

Please try adding below spl to the end of your search, it will dedup redundant links.

| eval ftlink=if(local_int>remote_int,local_int.remote_int,remote_int.local_int) 
| eval ft=if(from>to,from.to.ftlink,to.from.ftlink) 
| dedup ft 
| fields - ft
If this reply helps you an upvote and "Accept as Solution" is appreciated.

Zhanali
Path Finder

Thank you! It really works.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your terms, what is a redundant link and how do you determine this from your data?

0 Karma

Zhanali
Path Finder

Hi!

The first two lines describe such a connection between switches:

Zhanali_0-1627368881551.png

There is only one link between them. But each switch sees its neighbor and sends information about it, respectively, two records will appear in the table, and the Network Diagram Viz application builds two links between them. I need to somehow combine such records or just delete the second records.

This is what the actual topology looks like:

Zhanali_1-1627369376383.png

 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...