Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Filtering Netflow Reports by Subnet

A bit of a newbie here...

I'm roaming around in Report Writer trying to edit the Historical NetFlow Reports | Top 50 Endpoints report and I want to filter on a couple of subnets. For the sake of argument lets say these networks are:

1.1.0.0 / 255.255.240.0 (or 1.1.0.0/20 if you prefer)

2.2.2.0 / 255.255.255.0 (or 2.2.2.0/24)

What fields do I need to filter on to get this to work? Also what data should I provide for the fields?

I'm running - NPM 10.0.0 SP1, NTA 3.7.

Find more posts tagged with

Accepted answers

SpinnerRow

OK, I got it to work and ultimately, it was a simple fix. I just had to adhere to the proper "SQL LIKE" syntax by put a percent sign at the last of the text:

From this: 216.158

To this: 216.158%

That's all it took. The SQL statement above helped a lot. I still may do an advanced SQL report just to see how that works.

It would be very helpful if the report writer would do a syntax check first and post an error.

Thanks for the help!

All comments

SpinnerRow

Here is a screen shot ob me trying to to do. There must be an error in the SQL when I do this because hitting the SQL tab after I add this does nothing. I've tried several ways to look at the SQL so I can get an idea of what the data type is and what it is expecting in this field but so far no go.

SpinnerRow

Nobody has done this?

wrodenbusch

The column is nvarchar. What you are doing looks right to me but I cannot see your query in the screen shot. You should not have any / or * in your query.

wrodenbusch

Does it return results without the filter on?

SpinnerRow

It returns results without the filter and I'm not using a slash or asterisk in the argument.

berger

Report writer is kindof buggy from what I've seen. If you haven't gotten it to work yet, I suggest switching to SQL.

On the top bar -> report -> Show SQL
Then press on the, now viewable, SQL tab in design view
Now select and copy all the text, since you are unable to type in this view
Then create a new advanced SQL report, and paste it in there

Now look for the line under "SELECT", which pulls the actual IP line (you can remove one by one to see which one it is). And let's call the line <Interface.IP> for reference here (although you would obviously be using the actual line in SQL)

Now look for a line beginning with "WHERE", and add or change the following lines to look something like this (with whatever IPs you are using, % acts like a wildcard, so the LIKE statements would logically be "IP begins with 216.158")

WHERE

.......

......

AND

(

(<Interface.IP> LIKE '216.158%')

(<Interface.IP> LIKE '217.292%')

)