Add RegisteredDevice to compute, network, and hx cluster inventory

Author: jerewill-cisco

README.md

@@ -111,7 +111,7 @@ One for each sourcetype...
 | cisco:intersight:aaaAuditRecords | `index=* sourcetype=cisco:intersight:aaaAuditRecords MoType!=iam.UserPreference \| rename MoType as Type \| rename MoDisplayNames.Name{} as Object \| eval Request=json_extract(_raw,"Request") \| table source, Email, Event, Type, Object, Request` |
 | cisco:intersight:condAlarms | `index=* sourcetype=cisco:intersight:condAlarms \| dedup Moid \| search Severity != Cleared \| rename AffectedMoDisplayName as AffectedDevice \| table source, Name, AffectedDevice, Severity, Description` |
 | cisco:intersight:tamAdvisoryInstances | `index=* sourcetype=cisco:intersight:tamAdvisoryInstances \| dedup Advisory.Moid \| rename Advisory.BaseScore as CVSSBaseScore \| rename Advisory.AdvisoryId as Id \| rename Advisory.ObjectType as Type \| rename Advisory.Name as Name \| rename Advisory.Severity.Level as Severity \| rename Advisory.CveIds{} as Attached_CVEs \| table source, Name, Id, Type, CVSSBaseScore, Severity, Attached_CVEs` |
-| cisco:intersight:computePhysicalSummaries | `index=* sourcetype=cisco:intersight:computePhysicalSummaries \| dedup Moid \| rename NumCpuCoresEnabled as Cores \| rename TotalMemory as RAM \| eval RAM=RAM/1024 \| rename OperPowerState as Power \| rename AlarmSummary.Critical as Criticals \| rename AlarmSummary.Warning as Warnings \| table source, Power, Name, Model,Serial, Firmware, Cores, RAM, Criticals, Warnings`
+| cisco:intersight:computePhysicalSummaries | `index=* sourcetype=cisco:intersight:computePhysicalSummaries RegisteredDevice.ConnectionStatus!=Unclaimed \| dedup Moid \| rename NumCpuCoresEnabled as Cores \| rename TotalMemory as RAM \| eval RAM=RAM/1024 \| rename OperPowerState as Power \| rename AlarmSummary.Critical as Criticals \| rename AlarmSummary.Warning as Warnings \| rename RegisteredDevice.ConnectionStatus as Status \| eval Health=case(Criticals >= 1,"Critical", Warnings >= 1,"Warning", 1=1, "Healthy") \| table source, Power, Status, Health, Name, Model,Serial, Firmware, Cores, RAM`
 | cisco:intersight:condHclStatuses | `index=* sourcetype=cisco:intersight:condHclStatuses \| Table source, ManagedObject.Moid, Status, Reason, HardwareStatus, SoftwareStatus, ComponentStatus`
 | cisco:intersight:hyperflexClusters | `index=* sourcetype=cisco:intersight:hyperflexClusters \| dedup Moid \| rename Summary.ResiliencyInfo.State as State \| Table source,Name, State, HypervisorType,DeploymentType,DriveType,HxVersion,UtilizationPercentage`
 | cisco:intersight:hyperflexNodes | `index=* sourcetype=cisco:intersight:hyperflexNodes \| dedup Moid \| rename "Drives{}.Usage" as DriveUsage \| rename "EmptySlotsList{}" as EmptySlots \| eval PersistenceDiskCount=mvcount(mvfilter(match(DriveUsage, "PERSISTENCE"))) \| eval OpenDiskSlots=mvcount(EmptySlots) \| table source, HostName, ModelNumber, SerialNumber, Role, Hypervisor, Status, PersistenceDiskCount, OpenDiskSlots`

input_module_intersight.py

@@ -336,10 +336,10 @@ def write_splunk(index, source, sourcetype, data):
         results_per_page = 10  # adjust the number of results we pull per API call
         for i in range(0, count, results_per_page):
             RESPONSE = r_intersight(
-                f"{endpoint}?$top={results_per_page}&$skip={str(i)}")
+                f"{endpoint}?$expand=RegisteredDevice($select=ClaimedByUserName,ClaimedTime,ConnectionStatusLastChangeTime,ConnectionStatus,CreateTime,ReadOnly)&$top={results_per_page}&$skip={str(i)}")
             for data in RESPONSE.json()['Results']:
-                data = pop(['Ancestors', 'PermissionResources',
-                           'Owners', 'RegisteredDevice'], data)
+                data = pop(['Ancestors', 'PermissionResources','Owners'], data)
+                data['RegisteredDevice'] = pop(['ClassId', 'ObjectType'], data['RegisteredDevice'])
                 write_splunk(index, account_name,
                              'cisco:intersight:computePhysicalSummaries', data)
                 # try to get HCL data also
@@ -409,10 +409,11 @@ def write_splunk(index, source, sourcetype, data):
         results_per_page = 10  # adjust the number of results we pull per API call
         for i in range(0, count, results_per_page):
             RESPONSE = r_intersight(
-                f"{endpoint}?$top={results_per_page}&$skip={str(i)}")
+                f"{endpoint}?$expand=RegisteredDevice($select=ClaimedByUserName,ClaimedTime,ConnectionStatusLastChangeTime,ConnectionStatus,CreateTime,ReadOnly)&$top={results_per_page}&$skip={str(i)}")
             for data in RESPONSE.json()['Results']:
                 data = pop(['Ancestors', 'PermissionResources',
-                           'Owners', 'RegisteredDevice'], data)
+                           'Owners'], data)
+                data['RegisteredDevice'] = pop(['ClassId', 'ObjectType'], data['RegisteredDevice'])
                 write_splunk(
                     index, account_name, 'cisco:intersight:networkElementSummaries', data=data)
 
@@ -465,12 +466,13 @@ def write_splunk(index, source, sourcetype, data):
         results_per_page = 10  # adjust the number of results we pull per API call
         for i in range(0, count, results_per_page):
             RESPONSE = r_intersight(
-                f"{endpoint}?$expand=License&$top={results_per_page}&$skip={str(i)}")
+                f"{endpoint}?$expand=License,RegisteredDevice($select=ClaimedByUserName,ClaimedTime,ConnectionStatusLastChangeTime,ConnectionStatus,CreateTime,ReadOnly)&$top={results_per_page}&$skip={str(i)}")
             for data in RESPONSE.json()['Results']:
                 data = pop(['Alarm', 'Ancestors', 'ChildClusters', 'Owners', 'PermissionResources',
-                           'RegisteredDevice', 'StorageContainers', 'Nodes', 'Health', 'ParentCluster'], data)
+                           'StorageContainers', 'Nodes', 'Health', 'ParentCluster'], data)
                 data['License'] = pop(
                     ['Ancestors', 'Cluster', 'Owners', 'PermissionResources', 'RegisteredDevice'], data['License'])
+                data['RegisteredDevice'] = pop(['ClassId', 'ObjectType'], data['RegisteredDevice'])
                 write_splunk(index, account_name,
                              'cisco:intersight:hyperflexClusters', data)
 
@@ -496,7 +498,8 @@ def write_splunk(index, source, sourcetype, data):
                 data['PhysicalServer'] = pop(
                     ['ClassId', 'link'], data['PhysicalServer'])
                 if data['Drives'] == None:
-                    helper.log_warning(f"{s} | Hyperflex host {data['Moid']} has no list of drives")
+                    helper.log_warning(
+                        f"{s} | Hyperflex host {data['Moid']} has no list of drives")
                 else:
                     for i in range(0, len(data['Drives'])):
                         data['Drives'][i] = pop(