Splunk Search

Extracting Cisco Interfaces for duplex mismatch

pnelson
New Member

I have been trying now for the past couple weeks to get the IFX to work like I want it to and hoping someone can help from here.

Issue is sometimes we have duplex mismatches on the network and we would like to see that before instead of after.

When doing the IFX I get the following rex command.

rex "(?i) .*? (?P<FIELDNAME>\\w+/\\d+)(?=,)"

Sample event:

May 25 17:21:59 XXX.XXX.XXX 709399: May 25 17:21:58.912 UTC: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet0/1 (not full duplex), with _acc_sw01 GigabitEthernet1/0/8 (full duplex).

It works fine until I ask it to just look for the following %CDP-4-DUPLEX_MISMATCH which is specific to Cisco saying that the interface after it is in a state that does not match the state on the other side for duplex.

Would anyone have any suggestions on how to correct this problem?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

I would probably write my own regex for this, probably something like:

| rex "CDP-4-DUPLEX-MISMATCH.*on (<?interface>[^\s]+) \((?<state>[^)]+)\), with (?<host2>[^\s]+) (<?interface2>[^\s]+) \((?<state2>[^)]+)\)"
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...