The search queries runs searches across your entire deployment and enables you to find all types of entities based on the specified search term. Additionally, vRealize Network Insight provides suggestions to build the queries, which includes saved searches and recent searches that match the typed text in the global search bar.
- Structured Queries
A structured query consists of the following components:
- Entity Type: An entity type represents the type of object that we want to search. And it can be either in a singular form or in a plural form. The entity type is mandatory in a structured query.
Virtual machines
Hosts
Flows
MTU Mismatch Events
Problems
- Filters: The syntax for filter is as follows:
The syntax for condition is as follows:
A filter clause can be used to filter search results. The condition in a filter clause consists of property, comparison operator, and value. The conditions can be combined with logical operators to form complex conditions. Here is a list of the operators that you can use:Projections: A projection clause in a query decides what fields must be displayed from the filtered entities. This is an optional clause. If the projection clause is not specified, then the default set of fields is shown in the search results. A projection clause can contain any one of the following items:Operator Examples = flows where source ip address = '10.16.240.0/24'
flows where flow type = 'Source is VM'
!= vms where ip address != '10.17.0.0/16'
> vms where memory > 4096 mb
< vms where cpu usage rate < 70%
>= vms where memory >= 4096 mb
<= vms where cpu usage rate <= 70%
like vms where name like 'app'
not like vms where name not like 'app'
in flows where port in (22, 23, 80, 443)
vm where ip address in (192.168.91.11, 192.168.91.10)
not in flows where port not in (22, 23, 80, 443)
vm where ip address not in (192.168.91.11, 192.168.91.10)
is set vms where firewall rule is set
is not set vms where firewall rule is not set
() flows where (src tier = ‘App’ and destination tier = ‘DB’) OR (destination tier = ‘App’ and source tier = ‘DB’)
and flows where src tier = 'App' and destinationtier = 'DB'
or flows where flow type = 'Source is VMKNIC' or flow type = 'Destination is VMKNIC'
matches vm where name matches '.*'
vm where name matches 'a.*'
vm where name matches '[a-z]vm-delta[0-9]'
not matches vm where name not matches '.*'
vm where name not matches 'a.*'
vm where name not matches '[a-z]vm-delta[0-9]'
nested 'in' operator vm where in (vm where name = 'x')
vm where in (vm of host where name = 'x')
vm where host in (host of vm where name = 'x')
vm where name in (name of vm where name = 'x')
- Property
- Count
- List
- Aggregation
- Series
- Property: When entities are searched by an entity type, default set of properties are shown in the search results. Using projections, we can select the fields that should appear in the search results. For example,
os of vms
lists all virtual machines withOS property
in the search results.Here are some more examples:cpu cores of vms
source ip address of flows
If a metric property is used, a graph is displayed for each entity with the metric property as
y-axis
and time asx-axis
. - Count: The count query can be used to compute the number of objects of an entity type. Here are some examples:
count of vms
count of hosts
count of flows
- List: A list operator is helpful if the filter condition cannot be applied on the entity that you fetch.
For example:
List(host) of vms where memory <= 2gb
This query fetches list of hosts, whereas the filter condition is applied on virtual machines. For example,
Aggregate functions: An aggregate function allows you to calculate a single value from a numericalList(ip address)of vms where cpu cores = 1
config
ormetric
property. The search query language supports the following aggregate functions:max
sum
min
avg
-
sum(memory) of hosts
-
sum(memory), sum(cpu cores) of vms
sum(bytes) of flows
- Series: A series operator is used to perform aggregation on the metric properties. For example:
series(avg(cpu usage)) of vms where cpu cores = 4
series(sum(network usage)) of vms where name like 'app'
series(sum(memory usage)) of vms where name like 'db'
series(avg(cpu usage)), series(avg(memory usage)) of vms
- Ordering: The search results can be sorted using
order by
clause. Only one field is allowed inorder by
clause. Results are sorted in descending order by default.Here are some examples:
vms order by cpu cores
vms order by cpu cores asc
flows order by bytes
The
limit
clause can be used to limit the number of results. This must be preceded by theorder by
clause. For example:vms order by memory limit 5
- Grouping: The entities can be grouped by a property. When entities are grouped by a property, by default, the number of results in each group are shown. By adding a projection, sum/max/min of any property can be computed . Adding
order by
clause sorts the results. Iforder by
orprojection
clause is present in a query, then the aggregation function must be present.sum(bytes) of flows group by dest vm
This query is valid as the query has aggregation function in the projection clause. A query such as
Here are some examples:bytes of flows group by dest vm
is invalid as there is no aggregation function in the projection clause.vms group by host
sum (bytes) of flows group by dest vm order by sum(bytes)
- Entity Type: An entity type represents the type of object that we want to search. And it can be either in a singular form or in a plural form. The entity type is mandatory in a structured query.
- Entity Queries
Examples:
vms
,hosts
,flows
,nsx managers
- Search by entity name
- Search by full name: If the full name of an entity is known, it can be searched by enclosing the name in single quotes.
Examples:
'prod-68-1'
,'app1-72-1'
- Search by partial name: Search by a single word or multiple words fetches all the entities matching the input words.
Examples:
prod
,app1
Note: If input contains keywords or entity types, then it may be processed as a search query. - Search by entity type and name: If both the name and the type of an entity are known, it can be searched by querying entity type and entity name together.
Example: The search query
'vm app1'
returns all VMs containingapp1
.
- Search by full name: If the full name of an entity is known, it can be searched by enclosing the name in single quotes.
- Search by entity name
- Planning Queries
These queries can be used to plan the security of the data center by analyzing flows.
Examples:plan securitygroup1
plan host1
plan security
- Path Queries
These queries can be used to show the path between two VMs or the path from VM to Internet.
Examples:Vm 'vm1' to Vm 'vm2'
VM 'vm1' to Internet
- The search queries are not case-sensitive.
- The entity types or the configuration properties can have synonyms. For example, entity type
'virtual machine'
has synonym'vm'
.