Reply

VM Address History Report

Adviser
Posts: 267
1366     0
<form>
  <label>VM Address History</label>
  <description>System-created dashboard: Please clone before editing.</description>
  <fieldset submitButton="true" autoRun="true">
    <input type="time" token="time">
      <label>Time</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" token="members">
      <label>Members</label>
      <choice value="*">All</choice>
      <search>
        <query>sourcetype=ib:reserved2 source=ib:cloud:vm_address_history index=ib_cloud
               | stats count by host</query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>host="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
    </input>
    <input type="text" token="network">
      <label>Network (eg: *.168.1.*)</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="network_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="network_str">network="$value$"</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="network_view">
      <label>Network View</label>
      <choice value="All">All</choice>
      <search>
        <query>sourcetype=ib:reserved2 source=ib:cloud:vm_address_history index=ib_cloud
               | stats count by network_view</query>
        <earliest>$time.earliest$</earliest>
        <latest>$time.latest$</latest>
      </search>
      <fieldForLabel>network_view</fieldForLabel>
      <fieldForValue>network_view</fieldForValue>
      <change>
        <condition value="All">
          <set token="network_view_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="network_view_str">network_view="$value$"</set>
        </condition>
      </change>
      <default>All</default>
    </input>
    <input type="text" token="tenant_id">
      <label>Tenant ID</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="tenant_id_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="tenant_id_str">tenant_id="$value$"</set>
        </condition>
      </change>
    </input>
    <input type="text" token="TENANT_NAME">
      <label>Tenant Name</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="tenant_name_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="tenant_name_str">TENANT_NAME="$value$"</set>
        </condition>
      </change>
    </input>
    <input type="text" token="vlan_id">
      <label>VLAN ID</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="vlan_id_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="vlan_id_str">vlan_id="$value$"</set>
        </condition>
      </change>
    </input>
    <input type="text" token="location">
      <label>Location</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="location_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="location_str">location="$value$"</set>
        </condition>
      </change>
    </input>
    <input type="text" token="application_type">
      <label>Application Type</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="application_type_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="application_type_str">application_type="$value$"</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="address_type">
      <label>Address Type</label>
      <default>All</default>
      <choice value="All">All</choice>
      <choice value="0">Floating</choice>
      <choice value="1">Fixed</choice>
      <choice value="2">Private</choice>
      <choice value="3">Public</choice>
      <choice value="4">Elastic</choice>
      <change>
        <condition value="All">
          <set token="address_type_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="address_type_str">address_type=$value$</set>
        </condition>
      </change>
    </input>
    <input type="text" token="private_hostname">
      <label>Private Hostname</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="private_hostname_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="private_hostname_str">private_hostname=$value$</set>
        </condition>
      </change>
    </input>
    <input type="text" token="public_hostname">
      <label>Public Hostname</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="public_hostname_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="public_hostname_str">public_hostname=$value$</set>
        </condition>
      </change>
    </input>
    <input type="text" token="private_address">
      <label>Private Address (eg: *.168.1.*)</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="private_address_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="private_address_str">private_address=$value$</set>
        </condition>
      </change>
    </input> 
    <input type="text" token="public_address">
      <label>Public Address (eg: *.168.1.*)</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="public_address_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="public_address_str">public_address=$value$</set>
        </condition>
      </change>
    </input>
    <input type="text" token="elastic_address">
      <label>Elastic Address (eg: *.168.1.*)</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="elastic_address_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="elastic_address_str">elastic_address=$value$</set>
        </condition>
      </change>
    </input>
    <input type="text" token="mgmt_platform">
      <label>Management Platform</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="mgmt_platform_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="mgmt_platform_str">mgmt_platform=$value$</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="is_primary_ifc">
      <label>Is Primary Interface</label>
      <default>All</default>
      <choice value="All">All</choice>
      <choice value="0">No</choice>
      <choice value="1">Yes</choice>
      <change>
        <condition value="All">
          <set token="is_primary_ifc_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="is_primary_ifc_str">is_primary_ifc=$value$</set>
        </condition>
      </change>
    </input>  
    <input type="text" token="vpc_name">
      <label>VPC Name</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="vpc_name_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="vpc_name_str">vm_vpc_name=$value$</set>
        </condition>
      </change>
    </input> 
    <input type="text" token="vpc_addr">
      <label>VPC Network (eg: *.168.1.*)</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="vpc_addr_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="vpc_addr_str">vm_vpc_address=$value$</set>
        </condition>
      </change>
    </input>
    <input type="text" token="vm_hostname">
      <label>VM Hostname</label>
      <default>All</default>
      <change>
        <condition value="All">
          <set token="vm_hostname_str"><![CDATA[ ]]></set>
        </condition>
        <condition value="*">
          <set token="vm_hostname_str">vm_hostname=$value$</set>
        </condition>
      </change>
    </input>    
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>sourcetype=ib:reserved2 source=ib:cloud:vm_address_history index=ib_cloud 
                 $members$
                 $network_str$
                 $network_view_str$
                 $tenant_id_str$
                 $tenant_name_str$
                 $vlan_id_str$
                 $location_str$
                 $application_type_str$
                 $address_type_str$
                 $private_hostname_str$
                 $public_hostname_str$
                 $private_address_str$
                 $public_address_str$
                 $elastic_address_str$
                 $mgmt_platform_str$
                 $is_primary_ifc_str$
                 $vpc_name_str$
                 $vpc_addr_str$
                 $vm_hostname_str$
                 | eval IS_PRIMARY_IFC=case(is_primary_ifc==1, "Yes", is_primary_ifc==0, "No") 
                 | eval TYPE=case(address_type==0, "Floating", address_type==1, "Fixed", address_type==2, "Private", address_type==3, "Public", address_type==4, "Elastic", 1==1, address_type) 
                 | convert ctime(_time) as Time  
                 | sort -Time address network_view 
                 | rename address as "IP Address", TYPE as "Address Type", ACTION as "Action", IS_PRIMARY_IFC as "Is Primary Interface", mac_address as "MAC Address", port_id as "Port ID", cnames as "CNAME(s)", fqdn as "FQDN", vm_name as "VM Name/Instance Name", network as "Network", network_view as "Network View", tenant_id as "Tenant ID", TENANT_NAME as "Tenant Name", location as "Location", vlan_id as "VLAN ID", application_type as "Application Type", private_hostname as "Private Hostname", public_hostname as "Public Hostname", private_address as "Private Address", public_address as "Public Address", elastic_address as "Elastic Address", interface_name as "Interface Name", mgmt_platform as "Management Platform", vm_vpc_id as "VPC ID", vm_vpc_name as "VPC Name", vpc_addr as "VPC Network", vm_hostname as "VM Hostname"  
                 | table Time "IP Address" "Action" "Address Type" "MAC Address" "CNAME(s)" "Port ID" "FQDN" "VM Name/Instance Name" "Network" "Network View" "Tenant ID" "Tenant Name" "Location" "VLAN ID" "Application Type" "Private Hostname" "Public Hostname" "Private Address" "Public Address" "Elastic Address" "Interface Name" "Is Primary Interface" "Management Platform" "VPC ID" "VPC Name" "VPC Network" "VM Hostname"</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <progress>
            <condition>
              <unset token="conditional_value"></unset>
            </condition>
          </progress>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown>
          <set token="conditional_value">$row.IP Address$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table depends="$conditional_value$">
      <title>DHCP Lease History for Address= $conditional_value$</title>
        <search>
          <query>sourcetype=ib:dhcp:lease_history index=ib_dhcp_lease_history dhcpd OR dhcpdv6 r-l-e LEASE_IP="$conditional_value$"
                 | eval Protocol=if(PROTO=="dhcpdv6","IPV6","IPV4")
                 | eval LEASE_START=strftime(START_EPOCH,"%Y-%m-%d %H:%M:%S")
                 | eval LEASE_END=strftime(END_EPOCH,"%Y-%m-%d %H:%M:%S")
                 | eval FINGER_PRINT=if(isnull(OS_NUMBER),FP,SFP)
                 | rename host as "Member", ACTION as "Action", LEASE_IP as "Lease IP", MAC_DUID as "MAC/DUID", MEMBER_IP as "Member IP", OPTION12HOST as "Host Name", LEASE_START as "Lease Start", LEASE_END as "Lease End", FINGER_PRINT as "Fingerprint"
                 | convert ctime(_time) as Time
                 | table Time, Member, "Member IP", Protocol, Action, "Lease IP", "MAC/DUID", "Host Name", "Lease Start", "Lease End", "Fingerprint"</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>  
</form>
If you appreciate my efforts, please give me a kudo ↓ or Accept as solution to help others find it faster.
Showing results for 
Search instead for 
Do you mean 

Recommended for You