Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

Network Change & Configuration Management

Reply

Trying to create 2 device groups based on similar multiple criteria. 1 works fine, the other doesn't

New Member
Posts: 3
1039     0

Trying to create 2 device groups based on similar multiple criteria. 1 works fine, the other doesn't.

 

Custom Flag checks for specific VLANs on a switch and turns teh flag on if present.

 

Group 1 uses the custom flag and existing paramaters and seems to be working just fine.

$custom_VLANSEXISTS eq 'TRUE' and $Name like /TEST1/ or $Name like /TEST2/ or $Name like /TEST3/

 

When I create Group 2 that exludes the names to sort out those from the list, it doesn't work and inclues multiple devices that don't match the first criteria:

$custom_VLANSEXISTS eq 'TRUE' and $Name not like /TEST1/ or $Name not like /TEST2/ or $Name not like /TEST3/

 

Tried various formats of the same criteria above without success. 

 

$custom_VLANSEXISTS eq 'TRUE' and ($Name not like /TEST1/ or $Name not like /TEST2/ or $Name not like /TEST3/) - FAILED

 

Re: Trying to create 2 device groups based on similar multiple criteria. 1 works fine, the other doe

Expert
Posts: 70
1040     0

First, the parenthesis that you included in your first example are required for the affirmative test -- where any of the three patterns are matched.  Otherwise the boolean order of operations would first evaluate the "and", followed by the two "or" conditions.

 

If I understand correctly, you want to omit devices that match any of the three name patterns.  For the negative match, you need to use:

$Name not like /TEST1/ and $Name not like /TEST2/ and $Name not like /TEST3/

Since those are all "and" conditions, the parenthesis are not needed.

HTH,

-Marty

Re: Trying to create 2 device groups based on similar multiple criteria. 1 works fine, the other doe

New Member
Posts: 3
1040     0

Awesome, thanks that was it. Not sure why I didn't go that route. I apprecaite your help.

Showing results for 
Search instead for 
Did you mean: 

Recommended for You