An IP changed to transient, and I'm trying to figure out what used to be at the address. I can only see the last XX events, but can't search for events for a specific IP. Is that possible?
Great question. Long term we would like to increase our functionality around historical tracking of IP addresses. In the interim, you can modify the event count directly in the Last XX Event resource by clicking Edit and changing the number from 25 to 100.
The best way to find what you are looking for is to use the Report Writer (on the Orion server, Start->Programs->SolarWinds Orion->Alerting, Reporting, and Mapping->Report Writer). Find the IPAM Last 250 Events report and edit this report. On the Filter Results Tab, add a new elementary condition by clicking the button with three dots (...). Click the first star and select Events->Message. Change, "is equal to" to "contains" and change the last star to the IP Address that you are looking for. Click Execute SQL Query or Preview (select Preview if you are expecting more than 5 or 10 records to be returned).
Below is a screenshot from my report writer. I obfuscated the end portions of my addresses but I'm sure you get the idea. Does this help?
Mav
Hi Dan--
Marked for the PM to review.
M
Try creating an IPAM Event Log report similar to this... just change the IP Address
SELECT * FROM IPAM_Events WHERE ( (IPAM_Events.Message LIKE 'The IP %10.68.26.5%%'))
That worked great. Thanks
