Splunk Search

Network topology

Zhanali
Path Finder

Hi everyone!
Maybe someone faced such a problem:

I want to build a Layer 2 network topology, I have enough data for this. I am working with the Network Diagram Viz app. And I have a table of links, something like this:

from
tolocal_intremote_intlinkcolortypelinktextvalue
AIC-switch-2960.aic.kzSW9300test.aic.kzGi0/1Gi1/0/23greendeployment-serverGi0/1 to Gi1/0/23AIC-switch-2960.aic.kz
SW9300test.aic.kzAIC-switch-2960.aic.kzGi1/0/23Gi0/1greendeployment-serverGi1/0/23 to Gi0/1SW9300test.aic.kz
SW9300test.aic.kzSW3850test.aic.kzGi1/0/9Gi1/0/9 greendeployment-serverGi1/0/9 to Gi1/0/9SW9300test.aic.kz
SW9300test.aic.kzSW3850test.aic.kzGi1/0/10Gi1/0/10 greendeployment-serverGi1/0/10 to Gi1/0/10SW9300test.aic.kz
SW3850test.aic.kzSW9300test.aic.kzGi1/0/9Gi1/0/9 greendeployment-serverGi1/0/9 to Gi1/0/9SW3850test.aic.kz
SW3850test.aic.kzSW9300test.aic.kzGi1/0/10Gi1/0/10 greendeployment-serverGi1/0/10 to Gi1/0/10SW3850test.aic.kz
AIC-switch-2960.aic.kzSIP-W60BGi0/12WAN PORTgreenphone-squareGi0/12 to WAN PORTAIC-switch-2960.aic.kz

 

And, accordingly, in the topology, this is:

Zhanali_0-1627359025132.png

 

I took information about connected devices from AIC-switch-2960.aic.kz, SW9300test.aic.kz and SW3850test.aic.kz.

I just need to remove non-redundant links from the table. What solution can you advise to delete such entries automatically or some other way?

Thanks!

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Zhanali,

Please try adding below spl to the end of your search, it will dedup redundant links.

| eval ftlink=if(local_int>remote_int,local_int.remote_int,remote_int.local_int) 
| eval ft=if(from>to,from.to.ftlink,to.from.ftlink) 
| dedup ft 
| fields - ft
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Zhanali,

Please try adding below spl to the end of your search, it will dedup redundant links.

| eval ftlink=if(local_int>remote_int,local_int.remote_int,remote_int.local_int) 
| eval ft=if(from>to,from.to.ftlink,to.from.ftlink) 
| dedup ft 
| fields - ft
If this reply helps you an upvote and "Accept as Solution" is appreciated.

Zhanali
Path Finder

Thank you! It really works.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your terms, what is a redundant link and how do you determine this from your data?

0 Karma

Zhanali
Path Finder

Hi!

The first two lines describe such a connection between switches:

Zhanali_0-1627368881551.png

There is only one link between them. But each switch sees its neighbor and sends information about it, respectively, two records will appear in the table, and the Network Diagram Viz application builds two links between them. I need to somehow combine such records or just delete the second records.

This is what the actual topology looks like:

Zhanali_1-1627369376383.png

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...