search

inspired / cisco_ios

Cisco Networks
Other
7 stars 4 forks source link

Smart Call Home improvements #4

Closed guilhemmarchand closed 6 years ago

guilhemmarchand commented 8 years ago

Hi,

The "inventory_device" view references a lookup table called "Cisco_Device" which is not available anywhere in the App or the Addon.

cisco_ios/default/data/ui/views/inventory_device.xml

    <searchString>| inputlookup Cisco_Device | search host=$form.host$ | fields host | appendcols [search eventtype=cisco_ios-smart_call_home host=$form.host$ | rename hostname AS host | fields host | head 1]</searchString>

Splunk will return the following error as the lookup table does not exist: "The lookup table 'Cisco_Device' is invalid."

Is that expected ? Does this lookup table comes from an external App that should be installed ? I couldn't find that in your docs.

Thank you.

Guilhem

inspired commented 8 years ago

It's unfinished code, really. I'm looking at removing this functionality since it's very flaky. Smart Call Home is not the best way to get inventory data. I would much rather see some kind of inventory framework built into Splunk that we can use across apps.

The referenced lookup was previously generated by a saved search.

What do you suggest? Remove it completely? Smart Call Home isn't even working on Catalyst 2960 switches, the most deployed Enterprise switch worldwide, since they don't support scheduling. Enabling this on a 2960 will generate ONE Smart Call Home event, not periodically, so it can't be relied on for inventory.

guilhemmarchand commented 8 years ago

Hi,

No, i don't suggest removing the Smart Call Home service :-) I just was reporting the error due to an non existing lookup table.

The Smart Call Home service is a very cool idea, and a very very rich source of data. We are currently testing it, for now essentially with NX/OS devices, but we will also test it with our IOS devices.

I understand the Catalyst 2960 limitation (i would have thought the most common Catalyst device would have been some 37x families), therefore even if this is the most deployed device, this is as far is a know absolutely not the future of Cisco networking devices, and NX/OS has this feature working perfectly.

Definitively i wouldn't suggest removing it :+1:

inspired commented 8 years ago

Thanks for your input. If we focus on keeping SCH supported, the things on my road-map are:

inspired commented 6 years ago

Decided to remove SCH all together