Hello, i would link to obtain something similar to this https://drive.google.com/drive/folders/1Aua9EsQDS93T8LF6oQ-9AwO9ZPS-pKkt?usp=sharing image 1 coded as <panel> <table> <title>Port flapping</title> <search> <query>eventtype="cisco_ios-port_down" OR eventtype="cisco_ios-port_up" AND HOST IPs... | stats count,latest(port_status) AS port_status by host,src_interface | sort -count | table host,src_interface,port_status,count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="count">10</option> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <drilldown> <link target="_blank">search?q=eventtype="cisco_ios-port_down" OR eventtype="cisco_ios-port_up" | stats count,latest(port_status) AS port_status by host,src_interface | sort -count | table host,src_interface,port_status,count&amp;earliest=rt-1h&amp;latest=rt</link> </drilldown> </table> </panel> but with datas visible in DHCP snooping panel of Cisco App like this https:// drive.google.com /drive /folders /1Aua9EsQDS93T8LF6oQ-9AwO9ZPS-pKkt?usp=sharing image 2 coded as <panel> <table> <title>DHCP snooping events</title> <search> <query>eventtype="cisco_ios-dhcp_snooping" | table _time host facility mnemonic src_int src_vlan src_mac src_ip dest_mac dest_ip message_type num_packets</query> </search> <option name="count">20</option> <option name="displayRowNumbers">true</option> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> </table> </panel> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ by now i've done this https:// drive.google.com /drive /folders /1Aua9EsQDS93T8LF6oQ-9AwO9ZPS-pKkt?usp=sharing image 3 coded as <panel> <table> <title>DHCP snooping events</title> <search> <query> eventtype="cisco_ios-dhcp_snooping" | stats count,latest(num_packets) by host | sort -num_packets | table host mnemonic src_int src_vlan src_ip dest_ip message_type count </query> </search> <option name="count">10</option> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <drilldown> <link target="_blank">search?q=eventtype="cisco_ios-dhcp_snooping" | stats count,latest(num_packets) by host | sort -num_packets | table host mnemonic src_int src_vlan src_ip dest_ip message_type count</link> </drilldown> </table> </panel> as you can see the result is not the same, what i'm doing wrong? ... View more

hello guys, This is my simple query for port flapping detection eventtype="cisco_ios-port_down" OR eventtype="cisco_ios-port_up" AND ((host=10.29.18.*) OR (host=10.29.23.*)) OR ((host=10.29.72.*) OR (host=10.29.28.*)) OR ((host=10.11.40.*) OR (host=10.11.41.*) OR (host=10.11.42.*) OR (host=10.11.43.*) OR (host=10.11.44.*) OR (host=10.11.45.*) OR (host=10.11.46.*) OR (host=10.11.47.*) OR (host=10.11.2.*) OR (host=10.11.68.*) OR (host=10.11.2.*)) OR (host=10.29.56.*) | rex field=host "10\.29\.56\.(?<range_10_29_56>\d{1,3})" | where (range_10_29_56 >= 0 AND range_10_29_56 <= 127) | stats count,latest(port_status) AS port_status by host,src_interface | sort -count | table host,src_interface,port_status,count Any hint about why i'm only and always getting results from host in 10.29.56.X network? i'm sure about the existence of entries for others networks. many thanks ... View more

Hello, this threat to find a solution to this problem: i have many network as (host=10.29.4.*) not /24 but subnetted with |rex field=host "10.29.4.(?\d{1,3})" | where range>=48 AND range<=63 ->/27 so.. how to concatenate, eg.: (host=10.29.4.*) OR (host=10.29.10.*) |rex field=host "10\.29\.4\.(?<range>\d{1,3})" | where range>=48 AND range<=63 |rex field=host "10\.29\.10\.(?<range>\d{1,3})" | where range>=0 AND range<=63 Many thanks ... View more

Hello, i need to insert IP addresses here coded as follow: <input type="text" token="host" searchWhenChanged="false"> <default>*</default> </input> to be applied to: | pivot Cisco_IOS_Event Device last(hostname) AS "Hostname" last(site_id) AS "Site ID" last(model) AS "Model" last(serial_number) AS "Serial number" count(Device) AS "Count of events" SPLITROW host AS host and many others panels. I should need to understand where to insert in panel's queries the referens to search-box posted above. E.g.: in this query, search-box works fine and it outputs me only IPs int 10..29.10.x subnet: | pivot Cisco_IOS_Event Cisco_IOS_Event count(Cisco_IOS_Event) AS "Count of Cisco IOS Event" SPLITROW host AS host SPLITCOL severity_id_and_name FILTER host is "$host$" SORT 500 host ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 1 | sort -"0 - emergency", -"1 - alert", -"2 - critical", -"3 - error", -"4 - warning", -"5 - notification", -"6 - informational", -"7 - debugging" | table host "0 - emergency" "1 - alert" "2 - critical" "3 - error" "4 - warning" "5 - notification" "6 - informational" "7 - debugging" Hope to have explaned clearly. thanks UPDATE i'm going to this about this filter could be applied only to PIVOT queries.. because working a little bit more on the previous posted PIVOT query i had successful results. But e.g. on the following NON-PIVOT query i'm still have issues: eventtype=cisco_ios-duplex_mismatch | dedup dvc,cdp_local_interface | table _time,dvc,cdp_local_interface,cdp_neighbor,dest_interface,message_text | rename cdp_local_interface AS "Local Int.",cdp_neighbor AS "CDP Neighbor",dest_interface AS "Remote Int.",message_text AS "Message" | sort dvc ... View more