Here is a useful combination of a custom command and an NQE query to show the state of all OSPF neighbors.
OSPF data is not collected by default in Forward Enterprise, so we add the custom command "sh ip ospf neighbor"
Output data for this command from one device looks like this:
Command: sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
10.200.30.42 0 FULL/ - 00:00:35 10.45.6.1 GigE1/0/0
10.200.30.42 0 FULL/ - 00:00:32 10.45.6.2 GigE1/0/1
10.200.30.42 0 FULL/ - 00:00:35 10.45.6.3 GigE1/0/2
10.200.30.42 0 FULL/ - 00:00:31 10.45.6.4 GigE1/0/3
10.10.10.200 1 FULL/BDR 00:00:03 10.45.6.5 Vlan200This NQE query will list the OSPF neighbors from all devices by parsing the data from the custom command.
/**
* @intent Show OSPF neighbors on all devices collected with custom command 'sh ip ospf neighbor'
* @description Show OSPF neighbors on all devices collected with custom command 'sh ip ospf neighbor'
*/
pattern = ```
{neighbor_id:ipv4Address} {Pri:number} {State:string} {string} {Address:ipv4Address} {Interface:string}
```;
foreach d in network.devices
foreach c in d.outputs.commands
where c.commandText == "sh ip ospf neighbor"
let filtered_response = replace(c.response, "-", "")
let blocks = parseConfigBlocks(OS.IOS_XE, filtered_response)
foreach match in blockMatches(blocks, pattern)
// where !matches(match.data.State, "*FULL*")
select {
name:d.name,
neighbor_id: match.data.neighbor_id,
Pri: match.data.Pri,
State:match.data.State,
Address:match.data.Address,
Interface:match.data.Interface
}Note the following:
The "//" can be removed from the line "// where !matches(match.data.State, "*FULL*")" to see only OSPF neighbors that are NOT in the FULL state.
The command text in the query "sh ip ospf neighbor" must match the text in the custom command exactly. Since the custom command was entered with "sh" rather than "show", the query must also use "sh".
The pattern of the data in the command output must match the pattern at the top of the NQE. Since white space is used to determine where each field begins and ends, the lines in the command output with a "-" aren't the same as the line with no "-". We apply a filter to delete each "-". Then the data is parsed according to the pattern.
Since output from this command could differ based on device type, the NQE query may need to be expanded the parse each type of device data differently.
