Skip to content

Instantly share code, notes, and snippets.

@tonysangha
Last active May 25, 2021 04:55
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tonysangha/c8b9c10fb108837902857374a01f35e9 to your computer and use it in GitHub Desktop.
Save tonysangha/c8b9c10fb108837902857374a01f35e9 to your computer and use it in GitHub Desktop.
vRealize Network Insight Search Queries

vRealize Network Insight Resources

Getting started with a Cloud trial

  1. Request a 30 day Network Insight Cloud Trial - Request a Free Trial
  2. See Getting Started with vRealize Network Insight Cloud which outlines the requirements to onboard, how to sign-up and how to deploy.
  3. Adding a Data Source in vRealize Network Insight
  4. Configuring Flows in vRealize Network Insight

Links

Search Posts

Custom queries

Below is a setup of custom queries I have found useful, you can find more samples on the Search Exchange as well.

  1. List all issues that vRNI has found during a sampling period. Query will return:
  • Top 5 VMs by net usage
  • Top 5 VMs by CPU usage
  • Top 5 VMs by Ready time
  • Top 5 VMs by IOPS (R/W)
  • Top 5 VMs by max IO latency
  • Top 5 VXLANs by net usage
  • Top 5 Hosts by memory usage
  • Top 5 Datastores by R/W IOPS
  • Top 5 Switch Ports by Port usage
topn
  1. Show traffic to the Internet and Order it by bytes
flows where Flow Type = 'Internet'
flows where Flow Type = 'Internet' order by Bytes
  1. Path Query - Show path/flow from a VM to the internet or any other entity
VM 'VM-NAME' to 'Internet'
  1. Display Traffic between two subnets and order it by bytes and descending so largest flows are up top. Remember to change subnets to something unique to your environment
flow where Source Subnet Network = '192.168.103.0/24' and Destination Subnet Network = '172.16.32.0/24' order by bytes desc 
  1. Show VMs with RW IOPS and Network Rate greater than X
vms where RW IOPS > 100 and Network Tx Rate > 1 mbps
  1. Show RDP connections to VMs from a specific country
flows where Destination Port == 3389 and Source Country == 'United Kingdom'
  1. Show flows from the internet over TCP 22/23/3389 and group by country
flows where flow type = 'Source is internet' and port in (22,23,3389) group by source country
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment