Skip to main content

NQE Discussions

Find answers to your NQE questions and share NQEs you've developed.

  • 152 Topics
  • 351 Replies
152 Topics
GTurner
Employee
GTurnerEmployee
posted in NQE Discussions
Unlocking New Potential: Fixed-Length Encoding and NQE List Operations

Introduction Hello Community!  I wanted to share something I’ve been working on that may be helpful to you. It's a query designed to manipulate list arrays by transforming list elements into fixed-length strings, which then lets us easily join, split, or pop elements.  NQE built-in functions provide list iteration and for the most part, this satisfies data model iteration for our queries. The approach presented here extends NQE list operation abilities to manipulate lists or extract specific values when required.To accomplish this  we can apply a well known process called fixed-length string encoding which involves standardizing the length of each item in a list. By transforming variable-length strings into uniform sizes, we can “index” each item making if possible  to perform operations like joining, splitting, and extracting elements. It opens up new possibilities for customizing functions beyond the basics of list iteration and hopefully, it will serve as a helpful tool when you nee

771
G
Employee
V
Spotter
VarunS
asked in NQE Discussions
Invalid module path

[Resolved]Hi team,when I am trying to use one NQE query for public IPs from Forward Network NQE Library to use it further more on my query, I am getting error while using this. Its showing me module error. 

381
V
Spotter
G
Employee
GaryBEmployee
posted in NQE Discussions
Evaluating ACL rules from configuration to find last entry

I was asked by a customer to write an NQE check that would trigger a violation if there was not an explicit deny rule at the end of an ACL list. This query breaks down the acl list by acl name leveraging the group-by qualifier. We are also leveraging the `maxBy` function to find the last entry by leveraging the lineNumber property. // /**// * @intent Find acls by name, count and last entry// * @description test if there is an explicity deny rule at end of acl list// */acl_pattern_1 = `access-list {aclName:string} {!"remark"} {action:string} {rest:(string*)}`;maxLine(l) = l.line.lineNumber;foreach device in network.deviceswhere device.platform.vendor == Vendor.CISCOlet acls = patternMatches(device.files.config, acl_pattern_1)let acl_groups = (foreach acl in acls group acl as group_acls_by_name by { deviceName: device.name, aclName: acl.data.aclName } as v select { device

1312
Tyson Henrie
Employee
R
Spotter
Rohit_809 KumarSpotter
asked in NQE Discussions
how can i get F5 Vip ip and Pool address details by NQE

Hi Team , How can i get F5 VIP Ip and Pool address details by NQE. ThanksRohit

1638
davetee
Community Manager
deronjohnson
Employee
deronjohnsonEmployee
published in NQE Discussions
Renumber Lines in NQE OutputIntermediate

OverviewThis solution for renumbering line number defaults in NQEs addresses the issue of zero-based indexing by adding one to the line number output, aligning it with user expectations and conventional numbering in configuration files. This adjustment enhances usability and accuracy in network management by ensuring that outputs from NQEs are more intuitive and consistent with other data sources. Additionally, the logic can be applied to child line numbers, further improving the flexibility of the solution. Benefits Improved Usability: The adjustment aligns line numbers with user expectations, making outputs more intuitive and reducing confusion during configuration management and troubleshooting. Enhanced Accuracy: By providing one-indexed line numbers, the solution minimizes errors that could arise from mismatches between displayed and expected line numbers in configurations. Flexible Application: The logic used for renumbering can be extended to child line numbers, allowing for

280
deronjohnson
Employee
P
pjptsujitRamping Up
asked in NQE Discussions
Getting Pool and Pool members from device.outputs.commands

Under the command type F5_LTM_POOL_STATE for F5 devices, the pool and pool members are in the following format:---------------------------------------------------------------------------------------Ltm::Pool: XXX ---------------------------------------------------------------------------------------Status Availability : XXX State : XXX ... -------------------------------------------------------------- | Ltm::Pool Member: XXX -------------------------------------------------------------- | Status | Availability : XXX | State : XXX ... -------------------------------------------------------------- | Ltm::Pool Member: XXX -------------------------------------------------------------- | Status

671
G
Employee
V
Spotter
VarunS
asked in NQE Discussions
Fortinet SNMP Configurations

Hi Team,Can you please help me with a NQE Query to get SNMP configured IPs on Fortinet Devices. 

763
Christopher
Employee
D
Spotter
dakotaglorySpotter
asked in NQE Discussions
Custom source appends zeros to microsecond value; extractJson interprets as Float

I have a custom source that is appending zeros to the end of the microseconds which may be the cause of FN seeing it as a Float. Would it be possible in future versions to force a string data type so it might be manipulated or is there any other way I can manage this from the FN side?   Excited to begin using the date and timestamp functions.  Do you think they will become data types that could be used in the extractJson strings eventually? Custom source value:  extractJson code: If i change the value to Number or String the query errors because it sees that value as a Floatselect code:  Result:   

793
davetee
Community Manager
D
Spotter
dakotaglorySpotter
asked in NQE Discussions
Is it possible to extract a value from a subList?

parserecords(ep) =     foreach x in [0]    let recordid = extractJson[{        kind: String, selfLink: String, items:            List<{                subList:List                    List<{                        kind: String, selfLink: String, name: String                }>            }>    }]foreach hs in network.externalSources.httpSourcesforeach ep in hs.endpointswhere ep.name == "endpointname" && ep.statusCode == 200let recordItems = (min(parserecords(ep))).itemsforeach i in recordItemsselect {    SrcName: hs.name,    subListName: i.subList.name}///////////////////////// Oops! The query doesn't work ///////////////Address the following issues:        - Line xx, character xx: Can't access field 'name' from 'i.subList', because that is a List<{kind: String, selfLink: String, name:String}>.

756
D
Spotter
D
Spotter
dakotaglorySpotter
asked in NQE Discussions
Convert MicroSeconds in NQE

A custom source API call returns a date field in microseconds format. Does NQE have a built in function to convert? For example, 1725899407, to Sept. 9, 2024. Currently I don’t need the hours and minutes but in the future it may be necessary. I’ve searched “date” and “microseconds” in the documentation and online without success.

805
D
Spotter
D
Spotter
dakotaglorySpotter
asked in NQE Discussions
NQE Results Filter

Borrowing a capture of the Results window from another post on this site for reference, is it possible to filter for values that are not present?For example, instead of “cisco” could I return records that are !=cisco. I understand I have the options to write it in the NQE or export into Excel and filter as a spreadsheet but it would be useful to have the ability to filter other comparison operators on the fly in the Results window. 

462
D
Spotter
P
pjptsujitRamping Up
asked in NQE Discussions
How can I convert a Number to a String ?

Is there a command equivalent to str(X) in Forward Networks?

521
Andreas
Employee
P
pjptsujitRamping Up
asked in NQE Discussions
Can user defined functions return a Number?

For a user defined function as follows, can it be used to return a number or does it only return a Bool value? threshold : Number = 100;hasManySubInterfaces(iface) : Bool = length(iface.subinterfaces) > threshold; Say something like the following, is that possible? threshold : Number = 100;hasManySubInterfaces(iface) : Number= length(iface.subinterfaces) + threshold;

222
G
Employee
A
Spotter
AndyLSpotter
asked in NQE Discussions
Order the results in NQE

Is there any way to order the results in the NQE output ? E.g. order by field A then field B This would be within the query rather than once the results are shown in the table below the query itself.

371
Andreas
Employee
N
Spotter
NandSpotter
asked in NQE Discussions
Nqe query for BGP Admin status id down

Hi All, Can you please help me to write a NQE query for all ip details where BGP Admin status  id is showing down.

483
RobertWelch
Employee
D
Spotter
dakotaglorySpotter
asked in NQE Discussions
Parse externalSource HttpEndPoint API ResponseBody

Custom source profile with Endpoint that is using “url/path?_return_type=json-pretty” but responseBody is one long line.I attempt to use splitJsonObjects; however, it isn’t returning in a structured layout for me to pattern match.  

864
D
Spotter
V
Employee
Vladi BEmployee
posted in NQE Discussions
Best way to start writing a Parser - Part 2

In Part 1 of Best way to start writing a Parser I described how you can start writing a parser without running it against a snapshot, which can save a lot of time.I ended it with parsing the interface out of a device output blob.This Article will extend the same NQE, but I will extend the content of the information that we will be parsing for.As a reminder, here the final NQE from Part 1:test_string ="""GigabitEthernet0/0 is up, line protocol is up (connected) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is RJ45 output flow-control is XON, input flow-control is XON ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 25w3d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: Class-based queueing Output queue: 0/1

720
V
Employee
V
Employee
Vladi BEmployee
posted in NQE Discussions
Best way to start writing a Parser - Part 1

Are you new to NQE?Do you need to write a pattern match parser but don't know where to start?Do you want to test your pattern match without running it against your snapshot, because it takes too long for each iteration?Well, I have been there and here's what I've learned.If you start writing a parser, you'll most likely run into multiple iterations that won't give you the desired results. If you're as impatient as me, you'd like to get your test results quickly back so you can adjust the parser.To do this, you can:Take a sample of the config or device output and store it in a variable. Write the parser to run against this sample. Check if the result is what you expect. Modify the parser and run step 3 until you get your expected results.Well, that sounds easy enough! But how do you actually do each of these steps?Here's an example.For example, lets assume you have to lookup information from the "show interfaces" command on Cisco devices, something like this:GigabitEthernet0/0 is up, li

1420
V
Employee
R
rathidRamping Up
asked in NQE Discussions
Path MTU query

what is format to pass the  the path  parameter in Path Mtu consistency check ?is it a list of devices ? is it a traceroute ?or source or destination ip ? 

792
Tyson Henrie
Employee
A
alineamorimRamping Up
asked in NQE Discussions
NQE for OneIP table

How would one replicate the OneIP table with NQE, including info such as IP address, MAC address, vendor, switch name and switch port?

921
Andreas
Employee
G
Spotter
gbaronSpotter
asked in NQE Discussions
NQE to state whether NQE is a OS or Config match...or both.

I have an already pretty extensive NQE written to return a half dozen or so fields, but I cant figure out how to differentiate whether the CVE returned is a OS or Config match...or both.  Can someone help with that code?

432
G
Spotter
cariddir
Spotter
cariddirSpotter
asked in NQE Discussions
Using NQE to get BGP routes advertised.

Has anyone put together a simple Query to grab the advertised routes to a BGP Peer?I haven’t had much time to try, but maybe someone has done this on side.In summary, I want to try and associate routes to a device/location in our branch environment.foreach device in network.deviceswhere "Branch" in device.tagNames && "WAN" in device.tagNames I thought there would be some simple query in the model to just pull ‘bgp advertised routes’ and I could limit it with the above, and associate that route to that location. But after looking for 10 min, I couldn’t find anything of use. Anyway, if anyone has done something, it would be great to see/try. I saw a very ‘wild’ one on the community @baher , amazing work BTW.But i’m basically looking for the result of the routes advertised to any BGP neighbor.

834
Christopher
Employee
G
Spotter
gbaronSpotter
asked in NQE Discussions
NQE > External Sources > SNMP sources > Outputs > rawOidEntries

Hello:  I am not sure if this should be a discussion or question so apologies on that.  I have an NQE where I am pulling the raw Oid data and displaying the rawValue result as an output.  I want to be able to name each of those outputs so that its know to the public what that raw data represents.  One such example is a returned value of INV: 2.12 in the rawValue field.  But I would like to have know as hardware revision.I did apply names to the Oids in the custom source profile, but its not pulling that.  Can this be done?

14611
G
Spotter
N
Spotter
NandSpotter
asked in NQE Discussions
Forward Networks Cloud Objects Count difference through NQE Query

Hi Team,We want to fetch the Cloud objects difference count that compare today and yesterday(For example) Snapshot and provide the missing Cloud objects details which are missing from Current snapshot through NQE Query. Please assist us if anyone can relate with this.

211
G
Employee
Tyson Henrie
Employee
Tyson HenrieEmployee
posted in NQE Discussions
NHRP check for extraneous configs

This is a good example of how NQE can work well with IP subnet information.In this case the customer had found that the router's parser would not exclude misconfigurations. They found that some of the NHRP configuration commands had used the incorrect subnet.  The correct IP configs were there as well, but now it means there are extra config lines and it would be nice to clean these up. There were under 100 devices that were violations out of the tens of thousands of devices that were collected.Config segment from Cisco router with a violation.!interface Tunnel0 ip address 10.16.1.16 255.255.255.0 ip nhrp map multicast 172.16.16.1 ip nhrp map 10.6.16.1 172.16.16.1 <<--This command does not match the tunnel subnet ip nhrp map multicast 192.168.16.1 ip nhrp map 10.16.1.1 192.168.16.1 ip nhrp network-id 16 ip nhrp nhs 10.16.1.1!/** * @intent Find ip nhrp commands that are not in the same subnet as the tunnel subnet * @description The 'ip nhrp map' and 'ip nhrp nhs' address should be

330
Tyson Henrie
Employee
  • Community Contributor
    AricaFNhas earned the badge Community Contributor
  • NQE Collaborator
    gbaronhas earned the badge NQE Collaborator
  • Community Contributor
    CarlBhas earned the badge Community Contributor
  • Community Contributor
    gbaronhas earned the badge Community Contributor
  • Community Contributor
    Christopherhas earned the badge Community Contributor
Show all badges
Terms of UseCookie settings