sonar-set-ip-address

Synchronizes specified field values from an input record to the internal IP asset database.

Syntax

sonar-set-ip-address fields=FIELDS [batchsize=INT] [company=GUID]

Parameters

fields=FIELDS
List of fields to be synchronized, separated by a comma with a following space. See the Input Fields below for a detailed description.
Input Fields
FieldNameTypeLengthDescription
priorityPriority32-bit Integer 3 (High), 2 (Medium), 1 (Low)
category_nameDevice typeString255 char.Uncategorized if names are not matched
hostnameHost nameString255 char.Computer name or host name
workgroupWork groupString255 char.NT domain or work group
emp_keyAdmin(MAIN) employee keyString255 char.Input ignored if keys not matched
emp_key2Admin(SUB) employee keyString255 char.Input ignored if keys not matched
descriptionDescriptionString2000 char.
os_nameOSString50 char.
os_verOS versionString20 char.
macMAC addressString20 char.
locationInstall locationString255 char.
installedInstall dateDate
ext0Extended field #0String255 char.
ext1Extended field #1String255 char.
ext2Extended field #2String255 char.
ext3Extended field #3String255 char.
ext4Extended field #4String255 char.
ext5Extended field #5String255 char.
ext6Extended field #6String255 char.
ext7Extended field #7String255 char.
ext8Extended field #8String255 char.
ext9Extended field #9String255 char.
  • category_name: The device type is labeled as 'Uncategorized' if the device type value from the input record does not match the device type value in the database.

  • emp_key, emp_key2: The input is ignored if the employee key value in the input record does not match the employee key value in the database.

    Tip
    You can customize the IP asset database by applying global setting on sonar as follows:
    logpresso> sonar.setGlobalOption ip_custom_fields "0=Manufacturer,1=Model name"
batchsize=INT
Number of records to process per commit. The valid range for INT is from 1 to 5000. Specifying this parameter is particulaly useful when processing a large amount of IP address data, as it improves by reducing the number of transactions. However, if an error occurs during synchronization, the process fails for the entire batch.
company=COMPANY
Company (tenant) GUID identifier. If not specified, the GUID of the the company assigned to the user account is used as default. When running a query in a system account, you must specify the tenant GUID using this option.

Description

This command matches the ip field value from the input record to the IP values in the database. If a match is found, the corresponding object in the database is updated for the field values specified by the 'fields' option. If no match is found, a new entry is added to the database.

Input record must contain a valid IP address value in the ip field. The ip value can be either a string or an IP address. If any value of other type is provided, the synchronization fails and an invalid ip error code is generated to the _error field. When the ip value is null, an ip is null error code is output to the _error field.

When the fields option is used, any field that does not exist in the input record will be assigned a null value in the database. On the other hand, When the fields option is not specified, the field values will not be synced, even if the input record contains fields with the same names.

Output Fields

This query command returns all fields from the input record as is. If any error occurs, this query command returns an _error field in addition to the fields from input record.

FieldTypeDescription
_errorStringError description

Usage

  1. Sync the Genian NAC asset data to the internal IP asset database.

    The following example is using the app-extended command genian-nac-nodes. Users can synchronize the entire Genian NAC IP asset information to the Logpresso Sonar IP asset database.

    genian-nac-nodes 
    | rename nt_domain as workgroup, first_seen as installed, platform as os_name, nic_vendor as ext0, type as category_name
    | eval priority = if(category_name != "PC", 2, 1)
    | sonar-set-ip-address batchsize=10 fields="priority, category_name, hostname, workgroup, emp_key, emp_key2, description, os_name, os_ver, mac, location, installed, ext0"