Custom SWQL query for route flaps

A couple of notes here that should help.

First SWQL does not support the "Select <splat>" syntax. You must provide an explicit field list to the SELECT clause.

Second, many of the NPM objects in the SWIS schema use legacy object naming, and that may be adding to the confusion.

Try this for finding the "Top X route changes"...

SELECT TOP <XX> NodeID, LastDiscovery, InterfaceID, NextHop, RouteAge

FROM Cirrus.RouteTable

ORDER BY RouteAge

which should give you an ordered list showing the freshest routes at the top of the list.

You may wish to modify the actual fields retrieved from the table.

If that doesn't meet your needs, let me know and I'll get you connected with a more experienced engineer.

Also, we're doing a SolarWinds Lab episode on the SDK, API, SWIS, SWQL, PowerShell, etc., on November 13th.

You can view the live broadcast and/or sign up for notifications of future broadcasts at http://lab.solarwinds.com.

If I use that query i get this:

"Error: A query to the SolarWinds Information Service failed."

Also, where are you finding these tables names: LastDiscovery, NextHop, etc.?

The references are documented in the SDK.

On the SDK system, navigate from Start Menu -> Solarwinds Orion SDK -> Schema Documentation

As for the query failing... I'm double-checking on that, but I would ask you this:

How are you connecting to SWIS?

I'm not sure you how want to sort and group the data, but this SWQL query should get you started:

SELECT FlapId, NodeId, RouteDestinationGUID, RouteDestination, CIDR, DateTime, Ip_Address_Type, Ip_Version, RouteNextHop, Description, VrfIndex

FROM Orion.Routing.RoutingTableFlap

Thank you for the schema documentation. Interestingly, if I bring up the schema and search for "route" nothing shows up.

I'm using Windows auth. to connect to the database, I believe. If I look at the SQL Server service, it's running as Local System.

I must be doing something wrong here.....

What version of NPM are you using?

NPM 10.6

So, I just was poking around and found the SWQL studio, ran the following query, and got results...

Ultimately what I'd like to see is the same thing as the individual node results...

Except a network wide query that can be seen from the Custom Query window on the web view of our choice.

I appreciate all the help on this gents!!

Thanks,

Robert

I see the problem. Remove the "VrfIndex" property from the query and it should work. I forgot NPM 10.6 does not have VRF support yet. That's part of What are we working on after NPM 10.6