NQE Discussions

For any users that may be looking to leverage a query to gather information on devices to compare with an existing CMDB inventory, or looking to import data into their existing CMDB to update inventory. Please checkout this NQE: /** * @intent Basic information about Network Devices for CMDB import/compare */formatStatus(deviceSnapshotResult) = when deviceSnapshotResult is collectionFailed(collectionError) -> "Collecting - " + replace(toString(collectionError), "DeviceCollectionError.", ""); completed -> "Completed"; processingFailed(processingError) -> "Processing - " + replace(toString(processingError), "DeviceProcessingError.", "");foreach device in network.deviceslet platform = device.platformlet snapshotInfo = device.snapshotInfoforeach component in platform.componentsselect { Name: device.name, Location: device.locationName, Tags: device.tagNames, Vendor: platform.vendor, Model: platform.model, "Part Serial Number": component.serialNumber, "Interface Count": length(device.interfac

I have several questions around the NQE api endpoint for running a queries. This endpoint has parameters for limit and offset for the number of records to skip and how many records to request. (example from the documentation) { "query": "foreach d in network.devices select { Name: d.name }", "queryId": "FQ_ac651cb2901b067fe7dbfb511613ab44776d8029", "commitId": "84f84b0c0a0a1805ddff0ca5451c2c55c58605e5", "queryOptions": { "offset": 20, "limit": 100, "sortBy": { "columnName": "Name", "order": "ASC" }, "columnFilters": [ { "columnName": "Name", "value": "MyDeviceName" } ] }, "parameters": { "mtuThreshold": 123, "ntpServers": [ "10.22.2.3", "192.33.4.1" ] }} I have a few questions, and would appreciate any guidance the community can provide how do i know the total number of records that is available ? do i just ask for the next number of records and if none are returned then i have the full set ? if i run the api for a 2nd or 3rd time, with the offset amended, will it re-run the query from

Introduction Hello Community! I wanted to share something I’ve been working on that may be helpful to you. It's a query designed to manipulate list arrays by transforming list elements into fixed-length strings, which then lets us easily join, split, or pop elements. NQE built-in functions provide list iteration and for the most part, this satisfies data model iteration for our queries. The approach presented here extends NQE list operation abilities to manipulate lists or extract specific values when required. To accomplish this we can apply a well known process called fixed-length string encoding which involves standardizing the length of each item in a list. By transforming variable-length strings into uniform sizes, we can “index” each item making if possible to perform operations like joining, splitting, and extracting elements. It opens up new possibilities for customizing functions beyond the basics of list iteration and hopefully, it will serve as a helpful tool when you need t

[Resolved] Hi team,when I am trying to use one NQE query for public IPs from Forward Network NQE Library to use it further more on my query, I am getting error while using this. Its showing me module error.

I was asked by a customer to write an NQE check that would trigger a violation if there was not an explicit deny rule at the end of an ACL list. This query breaks down the acl list by acl name leveraging the group-by qualifier. We are also leveraging the ` maxBy` function to find the last entry by leveraging the lineNumber property. // /**// * @intent Find acls by name, count and last entry// * @description test if there is an explicity deny rule at end of acl list// */acl_pattern_1 = `access-list {aclName:string} {!"remark"} {action:string} {rest:(string*)}`; maxLine(l) = l.line.lineNumber; foreach device in network.deviceswhere device.platform.vendor == Vendor.CISCOlet acls = patternMatches(device.files.config, acl_pattern_1)let acl_groups = (foreach acl in acls group acl as group_acls_by_name by { deviceName: device.name, aclName: acl.data.aclName } as v select { device: v.deviceName, aclName: v.aclName, count: length(group_acls_by_name), last: maxBy(group_acls_by_name, maxLine) })f

Hi Team , How can i get F5 VIP Ip and Pool address details by NQE. Thanks Rohit

Overview This solution for renumbering line number defaults in NQEs addresses the issue of zero-based indexing by adding one to the line number output, aligning it with user expectations and conventional numbering in configuration files. This adjustment enhances usability and accuracy in network management by ensuring that outputs from NQEs are more intuitive and consistent with other data sources. Additionally, the logic can be applied to child line numbers, further improving the flexibility of the solution. Benefits Improved Usability: The adjustment aligns line numbers with user expectations, making outputs more intuitive and reducing confusion during configuration management and troubleshooting. Enhanced Accuracy: By providing one-indexed line numbers, the solution minimizes errors that could arise from mismatches between displayed and expected line numbers in configurations. Flexible Application: The logic used for renumbering can be extended to child line numbers, allowing for br

Under the command type F5_LTM_POOL_STATE for F5 devices, the pool and pool members are in the following format: ---------------------------------------------------------------------------------------Ltm::Pool: XXX ---------------------------------------------------------------------------------------Status Availability : XXX State : XXX ... -------------------------------------------------------------- | Ltm::Pool Member: XXX -------------------------------------------------------------- | Status | Availability : XXX | State : XXX ... -------------------------------------------------------------- | Ltm::Pool Member: XXX -------------------------------------------------------------- | Status | Availability : XXX | State : XXX I am trying to match the pattern to get the pool name and the members under that pool name. I am a little confused as there are multiple pool members under a single pool. Any help is appreciated!

Hi Team, Can you please help me with a NQE Query to get SNMP configured IPs on Fortinet Devices.

I have a custom source that is appending zeros to the end of the microseconds which may be the cause of FN seeing it as a Float. Would it be possible in future versions to force a string data type so it might be manipulated or is there any other way I can manage this from the FN side? Excited to begin using the date and timestamp functions. Do you think they will become data types that could be used in the extractJson strings eventually? Custom source value: extractJson code: If i change the value to Number or String the query errors because it sees that value as a Float select code: Result:

parserecords(ep) = foreach x in [0] let recordid = extractJson[{ kind: String, selfLink: String, items: List<{ subList:List List<{ kind: String, selfLink: String, name: String }> }> }] foreach hs in network.externalSources.httpSourcesforeach ep in hs.endpointswhere ep.name == "endpointname" && ep.statusCode == 200let recordItems = (min(parserecords(ep))).itemsforeach i in recordItemsselect { SrcName: hs.name, subListName: i.subList.name} ///////////////////////// Oops! The query doesn't work /////////////// Address the following issues: - Line xx, character xx: Can't access field 'name' from 'i.subList', because that is a List<{kind: String, selfLink: String, name:String}>.

A custom source API call returns a date field in microseconds format. Does NQE have a built in function to convert? For example, 1725899407, to Sept. 9, 2024. Currently I don’t need the hours and minutes but in the future it may be necessary. I’ve searched “date” and “microseconds” in the documentation and online without success.

Borrowing a capture of the Results window from another post on this site for reference, is it possible to filter for values that are not present? For example, instead of “cisco” could I return records that are !=cisco. I understand I have the options to write it in the NQE or export into Excel and filter as a spreadsheet but it would be useful to have the ability to filter other comparison operators on the fly in the Results window.

Is there a command equivalent to str(X) in Forward Networks?

For a user defined function as follows, can it be used to return a number or does it only return a Bool value? threshold : Number = 100;hasManySubInterfaces(iface) : Bool = length(iface.subinterfaces) > threshold; Say something like the following, is that possible? threshold : Number = 100;hasManySubInterfaces(iface) : Number= length(iface.subinterfaces) + threshold;

Is there any way to order the results in the NQE output ? E.g. order by field A then field B This would be within the query rather than once the results are shown in the table below the query itself.

Hi All, Can you please help me to write a NQE query for all ip details where BGP Admin status id is showing down.

Custom source profile with Endpoint that is using “url/path?_return_type=json-pretty” but responseBody is one long line. I attempt to use splitJsonObjects; however, it isn’t returning in a structured layout for me to pattern match.

In Part 1 of Best way to start writing a Parser I described how you can start writing a parser without running it against a snapshot, which can save a lot of time. I ended it with parsing the interface out of a device output blob. This Article will extend the same NQE, but I will extend the content of the information that we will be parsing for. As a reminder, here the final NQE from Part 1: test_string ="""GigabitEthernet0/0 is up, line protocol is up (connected) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is RJ45 output flow-control is XON, input flow-control is XON ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 25w3d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: Class-based queueing Output queue: 0/1000/64/0 (si

Are you new to NQE?Do you need to write a pattern match parser but don't know where to start?Do you want to test your pattern match without running it against your snapshot, because it takes too long for each iteration? Well, I have been there and here's what I've learned. If you start writing a parser, you'll most likely run into multiple iterations that won't give you the desired results. If you're as impatient as me, you'd like to get your test results quickly back so you can adjust the parser. To do this, you can: Take a sample of the config or device output and store it in a variable. Write the parser to run against this sample. Check if the result is what you expect. Modify the parser and run step 3 until you get your expected results. Well, that sounds easy enough! But how do you actually do each of these steps? Here's an example. For example, lets assume you have to lookup information from the "show interfaces" command on Cisco devices, something like this: GigabitEthernet0/0 i

what is format to pass the the path parameter in Path Mtu consistency check ? is it a list of devices ? is it a traceroute ?or source or destination ip ?

How would one replicate the OneIP table with NQE, including info such as IP address, MAC address, vendor, switch name and switch port?

I have an already pretty extensive NQE written to return a half dozen or so fields, but I cant figure out how to differentiate whether the CVE returned is a OS or Config match...or both. Can someone help with that code?

Has anyone put together a simple Query to grab the advertised routes to a BGP Peer?I haven’t had much time to try, but maybe someone has done this on side.In summary, I want to try and associate routes to a device/location in our branch environment. foreach device in network.devices where "Branch" in device.tagNames && "WAN" in device.tagNames I thought there would be some simple query in the model to just pull ‘bgp advertised routes’ and I could limit it with the above, and associate that route to that location. But after looking for 10 min, I couldn’t find anything of use. Anyway, if anyone has done something, it would be great to see/try. I saw a very ‘wild’ one on the community @baher , amazing work BTW. But i’m basically looking for the result of the routes advertised to any BGP neighbor.

Hello: I am not sure if this should be a discussion or question so apologies on that. I have an NQE where I am pulling the raw Oid data and displaying the rawValue result as an output. I want to be able to name each of those outputs so that its know to the public what that raw data represents. One such example is a returned value of INV: 2.12 in the rawValue field. But I would like to have know as hardware revision. I did apply names to the Oids in the custom source profile, but its not pulling that. Can this be done?