Community

parserecords(ep) =     foreach x in [0]    let recordid = extractJson[{        kind: String, selfLink: String, items:            List<{                subList:List                    List<{                        kind: String, selfLink: String, name: String                }>            }>    }]foreach hs in network.externalSources.httpSourcesforeach ep in hs.endpointswhere ep.name == "endpointname" && ep.statusCode == 200let recordItems = (min(parserecords(ep))).itemsforeach i in recordItemsselect {    SrcName: hs.name,    subListName: i.subList.name}///////////////////////// Oops! The query doesn't work ///////////////Address the following issues:        - Line xx, character xx: Can't access field 'name' from 'i.subList', because that is a List<{kind: String, selfLink: String, name:String}>.

A custom source API call returns a date field in microseconds format. Does NQE have a built in function to convert? For example, 1725899407, to Sept. 9, 2024. Currently I don’t need the hours and minutes but in the future it may be necessary. I’ve searched “date” and “microseconds” in the documentation and online without success.

Borrowing a capture of the Results window from another post on this site for reference, is it possible to filter for values that are not present?For example, instead of “cisco” could I return records that are !=cisco. I understand I have the options to write it in the NQE or export into Excel and filter as a spreadsheet but it would be useful to have the ability to filter other comparison operators on the fly in the Results window. 

Is there a command equivalent to str(X) in Forward Networks?

For a user defined function as follows, can it be used to return a number or does it only return a Bool value? threshold : Number = 100;hasManySubInterfaces(iface) : Bool = length(iface.subinterfaces) > threshold; Say something like the following, is that possible? threshold : Number = 100;hasManySubInterfaces(iface) : Number= length(iface.subinterfaces) + threshold;

Is there any way to order the results in the NQE output ? E.g. order by field A then field B This would be within the query rather than once the results are shown in the table below the query itself.

We were finally able to configure and get SSO online and operational this past week in our Dev environment, and pushed it in to the production world yesterday.  After running fine for about 10-12 hours, we came in this morning to the following error: SAML validation failed.  Invalid assertion [insert a bunch of random letters and numbers] for SAML response [insert more random letters and numbers]: Assertion IssueInstant was invalid, expiredContact your Org Admin to resolve the issue. I check with the in group that manages SSO and they claim nothing has changed on their end, so now I must ask:  How do we get past this so I can turn SSO back on? P.S. we are on base 11 app version 24.8 (rolling to 24.9 in a couple hours)

Scenario: Disabled all classic and all but one custom source in order to speed up and test an NQE with extractJson on an endpoint for a specific device. Observation: Unable to take a snapshot without at least one Classic source enabled.

The ability to include/exclude custom sources in bulk in the same way as classic sources would be useful if capability is possible. Secondary to an ability to bulk include/exclude custom sources would be the ability to bulk edit custom source profiles, basic authentication, SSL validation, and location.  I also noticed when editing custom source that I had to update in phases. I imported csv of devices.  I then attempted to update the profile and auth and location but it stated the source already existed and when I exited it only saved one of the settings. I then edited the src again and updated the location. If I recall it was unable to edit the tags at the same time as other config fields as well. No big deal for the few devices in my workspace and I have finished update but wanted to bring to your attention.

We are thrilled to announce the release of AI Assist for NQE! Whether you're new to the platform or a seasoned NQE expert, AI Assist allows you to skip complex syntax and describe what you need in plain English, making it easier than ever to create NQE queries. Generating an NQE query using AI AssistWhat is AI Assist?AI Assist enables you to write NQE queries using everyday language. Instead of manually writing complex queries, you can simply describe what you're looking for, and AI Assist will generate the appropriate NQE query for you. For example, to create a query that lists all CVEs currently impacting devices within a network, you can type, “List CVEs impacting each device,” and NQE AI Assist will instantly translate that

Hi All, Can you please help me to write a NQE query for all ip details where BGP Admin status  id is showing down.

Custom source profile with Endpoint that is using “url/path?_return_type=json-pretty” but responseBody is one long line.I attempt to use splitJsonObjects; however, it isn’t returning in a structured layout for me to pattern match.  

File this under “ya I’ll never do that again”.  We’ve all had at least one “oops” that sticks with us.How does one find Cisco Switches or Routers that just happen to have the same Hostname or the same Management IP Address reported in LLDP and / or CDP?  What if those alleged Cisco device just happen to have the same configuration except for the out of band management address?  Accidentally of course.  Well, this happened during a rapid stand up of two new Cisco routers.  (Not me, of course.  I learned this lesson many moons ago).   To speed up the deployment, a copy / paste of config from one Router to two others occurred.  Oh, yes, some nasty stuff happened after this.  But that’s not pertinent to the resolution.NQE to the rescue.  Since the Management IP addresses were “forgotten” or unknown to those troubleshooting the issue, how does one find these near identical twins?  Remember that CDP announces Serial Numbers.  LLDP typically does not adv

In Part 1 of Best way to start writing a Parser I described how you can start writing a parser without running it against a snapshot, which can save a lot of time.I ended it with parsing the interface out of a device output blob.This Article will extend the same NQE, but I will extend the content of the information that we will be parsing for.As a reminder, here the final NQE from Part 1:test_string ="""GigabitEthernet0/0 is up, line protocol is up (connected) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is RJ45 output flow-control is XON, input flow-control is XON ARP type: ARPA, ARP Timeout 04:

Are you new to NQE?Do you need to write a pattern match parser but don't know where to start?Do you want to test your pattern match without running it against your snapshot, because it takes too long for each iteration?Well, I have been there and here's what I've learned.If you start writing a parser, you'll most likely run into multiple iterations that won't give you the desired results. If you're as impatient as me, you'd like to get your test results quickly back so you can adjust the parser.To do this, you can:Take a sample of the config or device output and store it in a variable. Write the parser to run against this sample. Check if the result is what you expect. Modify the parser and run step 3 until you get your expected results.Well, that sounds easy enough! But how do you actually do each of these steps?Here's an example.For example, lets assume you have to lookup information

what is format to pass the  the path  parameter in Path Mtu consistency check ?is it a list of devices ? is it a traceroute ?or source or destination ip ? 

How would one replicate the OneIP table with NQE, including info such as IP address, MAC address, vendor, switch name and switch port?

I have an already pretty extensive NQE written to return a half dozen or so fields, but I cant figure out how to differentiate whether the CVE returned is a OS or Config match...or both.  Can someone help with that code?

Has anyone put together a simple Query to grab the advertised routes to a BGP Peer?I haven’t had much time to try, but maybe someone has done this on side.In summary, I want to try and associate routes to a device/location in our branch environment.foreach device in network.deviceswhere "Branch" in device.tagNames && "WAN" in device.tagNames I thought there would be some simple query in the model to just pull ‘bgp advertised routes’ and I could limit it with the above, and associate that route to that location. But after looking for 10 min, I couldn’t find anything of use. Anyway, if anyone has done something, it would be great to see/try. I saw a very ‘wild’ one on the community @baher , amazing work BTW.But i’m basically looking for the result of the routes advertised to any BGP neighbor.

Hello:  I am not sure if this should be a discussion or question so apologies on that.  I have an NQE where I am pulling the raw Oid data and displaying the rawValue result as an output.  I want to be able to name each of those outputs so that its know to the public what that raw data represents.  One such example is a returned value of INV: 2.12 in the rawValue field.  But I would like to have know as hardware revision.I did apply names to the Oids in the custom source profile, but its not pulling that.  Can this be done?

Is there a way to export all CVEs that the platform is scanning for.  We know how to get the ones that are affecting devices, but we want a list of them all, regardless of impact.

Hi Forward Networks team, I am looking at the API, specifically the call to get a device's data files.I can get the files for a single device at a time by just putting in the hostname in the parameters, however I was wondering if there is a parameter which will allow me to pull from multiple devices at once.For example lets say I want to pull from devices ABC, DEF, GHIorI want to pull from every device that starts with ABC*Is this something that can be done?Or would another possibility be to create a separate group of devices which includes all the devices I want to pull from and then just run the GET call on that device group. Kind regards,Sebastian

Hello,I have a question when using the Search Path API.Could we get an elaboration on the meaning of that “DELIVERED_TO_INCORRECT_LOCATION” forward outcome status, such as why it appears and if there’s anything we can do to address the “INCORRECT_LOCATION” part, if it’s necessary?I presume the status means that somewhere along the routing, it somehow ended up at a destination Forward Networks didn’t expect. But I just wanted to know if there was any more to it.Thanks!

Hi Team,We want to fetch the Cloud objects difference count that compare today and yesterday(For example) Snapshot and provide the missing Cloud objects details which are missing from Current snapshot through NQE Query. Please assist us if anyone can relate with this.

Identifying all the IP addresses on your network can be a complex and tedious task - and even impossible on some networks. This NQE makes it significantly easier to identify all the IP addresses in use on your network, including those that are stale or obsolete.   OverviewThis NQE identifies IPv4 and IPv6 addresses that are in use within the network. Due to the scarcity and value of IPv4 addresses, companies often seek to maximize their utilization and identify any under utilized address space. This can help to either improve the utilization of owned addresses or free up unused address space for sale. Whether you’re consolidating for financial purposes or re-IPing due to mergers, acquisitions, or network reorganizations, this