Mapping F5 Big-IP to Host or IP with SWQL

[timt]

Hi,

I hope this is an easy question. 

I am trying to map out our current IP, to see if they are part of the F5 load balancer. 

I came to the orion.f5.LTM.VirtualIPAddress table, however there does not seem to have any unique identifier to join the orion.nodes table.  Also, that the IPAddress table has %(port numbers?) appended to it. 

Am I looking in the correct place?

Please help, much appreciated.  Thank you!

[timt]

Does anyone knows how to remove the trailing %65535 from the  F5, Virtual IP Address?

[tdanner · Accepted solution]

In Orion Platform 2018.2/NPM 12.3 (currently in beta), SWQL gains the CHARINDEX function. With that and the existing SUBSTRING function, you can remove a trailing %65536. Like this:

SELECT SUBSTRING(IPAddress, 1, CHARINDEX('%', IPAddress)-1) AS TrimmedIPAddress

FROM Orion.F5.LTM.VirtualIPAddress

[timt]

Thanks TD, I guess I'll need to wait until 12.3 is released

[chad.every]

Try this, i added the Orion node name (caption) to the query

SELECT IPAddressID, IPAddressIndex, NodeID, Name, IPAddress, Enabled, F5Status, F5StatusReason, OrionStatus, Description, ShortName, F5StatusDescription, OrionStatusDescription, EnabledDescription, F.Device.Node.Caption

FROM Orion.F5.LTM.VirtualIPAddress F

The mapping looks like Orion.F5.LTM.VirtualIPAddress >> Device (Orion.F5.System.Device) >> Nodes (Orion.Nodes).

[timt]

Thanks for the help, but that only maps directly to the F5 devices. 

I'm looking to map the IP/Host of the node to join into the IP address field.

[Martin.Krivanek]

Unfortunately, I don't think that's possible, because of "%port number". That would require more complex parsing which isn't possible in SWQL. Nonetheless Chad's answer is relevant, what you'd typically monitor is physical devices to where you can navigate through F5 device.

If you're monitoring virtual IP addresses, the only workaround I can think of is setting manually Node's caption to match the "ip%port" pattern and match based on Caption = Virtual IP Address.

[timt]

Thanks Martin, do you have a sample query to do the match based on IP%port pattern that you can share, please?