15. Searching

NetSpyGlass allows you to search your network, easily finding devices, interfaces, hardware components and more. Just enter some text and press Enter.

Your search results are grouped into categories based on the type of item found (devices, alerts, etc.). The number of matches in each category is shown on the left, and the result list for a selected category is shown on the right.

Clicking on an item in the results will expand it to show more details about that item.

15.1. Searching for patterns

You can use the * wildcard to search for substring patterns. The * will match any characters (including no characters):

• juniper (matches “juniper”)
• junip* (matches anything starting with “junip”)
• *uniper (matches anything ending with “uniper”)

You can also exclude a term by preceding it with -:

• -juniper (matches anything NOT containing the word “juniper”)

15.2. Searching specific fields

Being able to type any string and find matches is very convenient, but sometimes you want a more focused search. You can limit your search to a specific field by preceding your search term with the field name and a colon:

• address:10.0.0.42

Note that tags, including your custom tags, are all searchable fields:

• VlanID:1250 (find items with VLAN ID 1250)
• Vendor:cisco (find items with Cisco as vendor)
• Role:ebgppeer (find items tagged as eBGP peers)
• Model:*ChassisN5k* (find Nexus 5000 devices)

Also note that searching is generally case-insensitive, but field names currently are not. A future release will relax this limitation.

15.2.1. Some common searchable fields (see Appendix for full list)

Field	Displayed as
device		Devices, interfaces, and hardware components all have a name field. To disambiguate, these name fields are aliased as “device”, “interface”, and “component”
address	IP Adddress	IPv4 or IPv6 address; search using CIDR notion (see below)
compClass	Component Type	Type of hardware component (“cpu”, “fan”, etc )
Role	Role	Role such as “router”, “switch”, “firewall”, etc.
Vendor	Vendor	Vendor of the device, interface, or hardware component.
Model	Model	Model of the device, interface, or hardware component
VlanName	VlanName	Name of the VLAN associated with the device or interface

15.3. Combining search terms with AND

If you enter more than one search term, the search will include everything that matches ANY of the terms. That is, terms are combined with logical OR operator by default. The results will be the union of the results from all search terms.

You can instead use the AND operator to make the results only contain items that match both search terms. That is, the results will be the intersection of the results from either search term.

• Role:switch and VlanID:1250 (find switches in vlan 1250)
• Vendor:cisco and compClass:fan (find Cisco fan components)

Note

If you use the AND operator, all terms are combined with AND. This allows you to do many useful searches, but is limited. A future release will provide a more comprehensive query syntax, supporting mixed ORs and ANDs and parentheses to indicate order of operations.

15.4. IP addresses

To search for IP addresses, use CIDR subnet notation:

• 10.3.250* (won’t work as you might expect)
• 10.3.250.0/24 (use CIDR prefix notation instead)

15.5. Narrowing your search with Filters

When viewing results, many of the properties of the items you find can themselves be used to focus or pivot your search. When you click one of these items, you will have the choice of:

• Narrowing the results to only include items that match the clicked value
• Narrowing the results by excluding the clicked value
• Starting a new search for just the clicked value

Active filters are displayed in the filterbar. You can click these to fine-tune the filter if needed, or to remove the filter.

15.6. Search examples

Find all fans on device named “server01”:

• device:server01 * and compClass:fan

Where do we peer with AS174?

• AS174

Find interfaces with ISIS level2 metric 10:

• ISISLevel2Metric:10

Find all interfaces in OSPF area 3:

• OSPFArea:3

Find all devices that have power supply with model:

• Model:”WS-C3560X-48P-S” (must be quoted)

Find all models of power supplies we have across all Cisco 6509 devices:

• compClass:powerSupply and Model:cat6509