About nirmeshsolanki

nirmeshsolanki · ‎10-20-2020

Hi @Nisha18789 Thanks a lot for the help in the previous query, I missed adding one more detail on the previous post which is : Messages which I see in my column: 1.[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"] 2.[name="IPBLOCKTYPE",value="Public",descendants_action={option_with_ea:"INHERIT",option_without_ea:"NOT_INHERIT"},operation="OVERRIDE"] Your solution works perfectly for 1st logic, need to add some query to the second option which would block descendants_action in the query which you provided earlier. Thanks a lot again.

nirmeshsolanki · ‎10-20-2020

Worked perfectly. Thanks a lot.

nirmeshsolanki · ‎10-16-2020

Hi @Nisha18789 , I am looking for an output "OVERRIDE" in the column IP_BLOCK_TYPE. so we have the below outputs in the column: Public Private",descendants_action={option_with_ea:"INHERIT",option_without_ea:"NOT_INHERIT"},operation="OVERRIDE Public",operation="OVERRIDE But I am just looking for values containing OVERRIDE. Thanks

nirmeshsolanki · ‎10-16-2020

@somisoni2 the query you provided gives me "Publi" and "Privat" outputs in the table.

nirmeshsolanki · ‎10-16-2020

@somesoni2 The query you provided, gives me all the possible results which come under IP_BLOCK_TYPE

nirmeshsolanki · ‎10-16-2020

Hello, Looking for some assistance with the existing query rex max_match=0 field=_raw "IP BLOCK TYPE\",value=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"| eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1) This query gives us a column with outputs Need assistance with pulling exact details in the column which will only have "OVERRIDE". Thanks

nirmeshsolanki · ‎09-30-2020

source=ib:discovery:switch_port_capacity index=ib_discovery | fillnull value="N/A" | dedup network_view device_ip_address interface_ip_address | join type=inner InterfaceSubnet, network_view [search sourcetype=ib:ipam:network index=ib_ipam | dedup NETWORK, view | rename NETWORK as InterfaceSubnet view as network_view | fields InterfaceSubnet, network_view, allocation] | APPEND [search sourcetype=ib:ipam:network index=ib_ipam | dedup NETWORK, view | rename NETWORK as InterfaceSubnet view as network_view | join type=left InterfaceSubnet, network_view [search source=ib:discovery:switch_port_capacity index=ib_discovery | fields InterfaceSubnet, device_ip_address, network_view] | where isnull(device_ip_address)] | rename InterfaceSubnet as "IPAM Network" allocation as "Utilization %" device_ip_address as "Device IP" interface_ip_address as "Interface IP" device_model as "Device Model" device_vendor as "Device Vendor" device_version as "Device OS Version" device_name as "Device Name" network_view as "Network View" | table "IPAM Network", "Utilization %", "Network View", "Device IP", "Device Name", "Interface IP", "Device Model", "Device Vendor", "Device OS Version"

nirmeshsolanki · ‎09-30-2020

Hi Team, Needs assistance with merging two reports and their query and producing a new query/report having all the content of both the reports. IPAMv4 Device Networks source=ib:discovery:switch_port_capacity index=ib_discovery | fillnull value="N/A" | dedup network_view device_ip_address interface_ip_address | join type=inner InterfaceSubnet, network_view [search sourcetype=ib:ipam:network index=ib_ipam | dedup NETWORK, view | rename NETWORK as InterfaceSubnet view as network_view | fields InterfaceSubnet, network_view, allocation] | APPEND [search sourcetype=ib:ipam:network index=ib_ipam | dedup NETWORK, view | rename NETWORK as InterfaceSubnet view as network_view | join type=left InterfaceSubnet, network_view [search source=ib:discovery:switch_port_capacity index=ib_discovery | fields InterfaceSubnet, device_ip_address, network_view] | where isnull(device_ip_address)] | rename InterfaceSubnet as "IPAM Network" allocation as "Utilization %" device_ip_address as "Device IP" interface_ip_address as "Interface IP" device_model as "Device Model" device_vendor as "Device Vendor" device_version as "Device OS Version" device_name as "Device Name" network_view as "Network View" | table "IPAM Network", "Utilization %", "Network View", "Device IP", "Device Name", "Interface IP", "Device Model", "Device Vendor", "Device OS Version" IP Address Inventory source=ib:ipam:ip_address_inventory index=ib_ipam | sort 0 -_time, +ip(ip_address) | fillnull value="" | dedup network_view ip_address | eval last_discovered_timestamp=strftime(last_discovered_timestamp,"%Y-%m-%d %H:%M:%S") | eval first_discovered_timestamp=strftime(first_discovered_timestamp,"%Y-%m-%d %H:%M:%S") | rename network_view as "Network View" ip_address as "IP Address" discovered_name as "Discovered Name" port_vlan_name as "Vlan Name" port_vlan_number as "Vlan ID" vrf_name as "VRF Name" vrf_description as "VRF Description" vrf_rd as "VRF RD" bgp_as as "BGP AS" first_discovered_timestamp as "First Seen" last_discovered_timestamp as "Last Seen" managed as "Managed" management_platform as "Management Platform" | table "IP Address" "Discovered Name" "First Seen" "Last Seen" "Network View" "Managed" "Management Platform" "Vlan Name" "Vlan ID" "VRF Name" "VRF Description" "VRF RD" "BGP AS"

Posts	8
Solutions	0
Karma Given	1
Karma Received	3
Member Since	‎09-30-2020

Online Status	Offline
Date Last Visited	‎10-20-2020 10:50 AM

Extracting multiple values from Rex

Merging two existing splunk reports and combining ...

Re: Extracting multiple values from Rex

Re: Extracting multiple values from Rex

Re: Extracting multiple values from Rex

Re: Extracting multiple values from Rex

Re: Extracting multiple values from Rex

Extracting multiple values from Rex

Re: Merging two existing splunk reports and combin...

Merging two existing splunk reports and combining ...