Splunk Search

Network topology

Zhanali
Explorer

Hi everyone!
Maybe someone faced such a problem:

I want to build a Layer 2 network topology, I have enough data for this. I am working with the Network Diagram Viz app. And I have a table of links, something like this:

from
tolocal_intremote_intlinkcolortypelinktextvalue
AIC-switch-2960.aic.kzSW9300test.aic.kzGi0/1Gi1/0/23greendeployment-serverGi0/1 to Gi1/0/23AIC-switch-2960.aic.kz
SW9300test.aic.kzAIC-switch-2960.aic.kzGi1/0/23Gi0/1greendeployment-serverGi1/0/23 to Gi0/1SW9300test.aic.kz
SW9300test.aic.kzSW3850test.aic.kzGi1/0/9Gi1/0/9 greendeployment-serverGi1/0/9 to Gi1/0/9SW9300test.aic.kz
SW9300test.aic.kzSW3850test.aic.kzGi1/0/10Gi1/0/10 greendeployment-serverGi1/0/10 to Gi1/0/10SW9300test.aic.kz
SW3850test.aic.kzSW9300test.aic.kzGi1/0/9Gi1/0/9 greendeployment-serverGi1/0/9 to Gi1/0/9SW3850test.aic.kz
SW3850test.aic.kzSW9300test.aic.kzGi1/0/10Gi1/0/10 greendeployment-serverGi1/0/10 to Gi1/0/10SW3850test.aic.kz
AIC-switch-2960.aic.kzSIP-W60BGi0/12WAN PORTgreenphone-squareGi0/12 to WAN PORTAIC-switch-2960.aic.kz

 

And, accordingly, in the topology, this is:

Zhanali_0-1627359025132.png

 

I took information about connected devices from AIC-switch-2960.aic.kz, SW9300test.aic.kz and SW3850test.aic.kz.

I just need to remove non-redundant links from the table. What solution can you advise to delete such entries automatically or some other way?

Thanks!

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Zhanali,

Please try adding below spl to the end of your search, it will dedup redundant links.

| eval ftlink=if(local_int>remote_int,local_int.remote_int,remote_int.local_int) 
| eval ft=if(from>to,from.to.ftlink,to.from.ftlink) 
| dedup ft 
| fields - ft
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Zhanali,

Please try adding below spl to the end of your search, it will dedup redundant links.

| eval ftlink=if(local_int>remote_int,local_int.remote_int,remote_int.local_int) 
| eval ft=if(from>to,from.to.ftlink,to.from.ftlink) 
| dedup ft 
| fields - ft
If this reply helps you an upvote is appreciated.

View solution in original post

Zhanali
Explorer

Thank you! It really works.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your terms, what is a redundant link and how do you determine this from your data?

0 Karma

Zhanali
Explorer

Hi!

The first two lines describe such a connection between switches:

Zhanali_0-1627368881551.png

There is only one link between them. But each switch sees its neighbor and sends information about it, respectively, two records will appear in the table, and the Network Diagram Viz application builds two links between them. I need to somehow combine such records or just delete the second records.

This is what the actual topology looks like:

Zhanali_1-1627369376383.png

 

0 Karma