LLD filter not working

[mdw]

I've been using LLD filters to limit discovery and it's been working OK, but now I have a filter that I cannot figure out. I have the following discovery output (just a snippet):

  {
    "{#SNMPINDEX}": "38489.2",
    "{#SEVERITY}": "20",
    "{#EVALUATION}": "2"
  },
  {
    "{#SNMPINDEX}": "300000003.1",
    "{#SEVERITY}": "20",
    "{#EVALUATION}": "2"
  },

I want to filter out the entries where SNMPINDEX's first element is not 5 digits (in above sample it's the second entry that should be removed). Should be easy right? I add following filter rule:

{#SNMPINDEX} matches ^\d{5}\.\d+$

The regex is valid and works (I verified) but nothing gets filtered out. I tried replacing \d{5} with \d\d\d\d\d, but it changes nothing. Any ideas?

Edit: I just tried matching nonsensical string and both 'matches' and 'does not match' and nothing ever gets filtered out. Seems like the filter has no effect no matter what. I am starting to suspect that filtering by {#SNMPINDEX} simply doesn't work.

[cyber]

How do you manage to get such values to built-in macro?

https://www.zabbix.com/documentation/current/en/manual/discovery/low_level_discovery/examples/snmp_oids

A built-in macro {#SNMPINDEX} containing index of the discovered OID is applied to discovered entities. The discovered entities are grouped by {#SNMPINDEX} macro value.

[mdw]

How do you manage to get such values to built-in macro?

https://www.zabbix.com/documentation...ples/snmp_oids

These come from MIB sequences. For example:

entSensorThresholdTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF EntSensorThresholdEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table lists the threshold severity, relation, and
        comparison value, for a sensor listed in the Entity-MIB
        entPhysicalTable."
    ::= { entSensorThresholds 1 }

Which produces something like this:

$ snmpbulkwalk strs00v entSensorThresholdSeverity
CISCO-ENTITY-SENSOR-MIB::entSensorThresholdSeverity.38486.1 = INTEGER: minor(10)
CISCO-ENTITY-SENSOR-MIB::entSensorThresholdSeverity.38486.2 = INTEGER: major(20)
CISCO-ENTITY-SENSOR-MIB::entSensorThresholdSeverity.38487.1 = INTEGER: minor(10)
CISCO-ENTITY-SENSOR-MIB::entSensorThresholdSeverity.38487.2 = INTEGER: major(20)
CISCO-ENTITY-SENSOR-MIB::entSensorThresholdSeverity.38488.1 = INTEGER: minor(10)
CISCO-ENTITY-SENSOR-MIB::entSensorThresholdSeverity.38488.2 = INTEGER: major(20)
...

But I think this is besides the point. The problem is that you don't seem to be able to filter by {#SNMPINDEX} at all.

[Hamardaban]

Create your own LLD macro (referring to the data you need) and filter using it.

[mdw]

Create your own LLD macro (referring to the data you need) and filter using it.

I have no idea how would that work for OID discovery. Yes, I have read the docs.

[Hamardaban]

Do you use this LLD https://www.zabbix.com/documentation...ples/snmp_oids ?

[cyber]

Are you using {#SNMPINDEX} as one of macro names in discovery command? If yes, then you should not... find some other name for that particular LLD macro.. It may conflict with built-in one... Built-in just goes 1, 2 , 3... N. for each discovered set of things.. It should not look like yours..

And just in case, what version you are using? From 6.4, there is some new options for smnp discovery (walk), which I am not familiar with...

[mdw]

Are you using {#SNMPINDEX} as one of macro names in discovery command? If yes, then you should not... find some other name for that particular LLD macro.. It may conflict with built-in one... Built-in just goes 1, 2 , 3... N. for each discovered set of things.. It should not look like yours..

It's the built-in. Again, it's result of a sequence sub-index, see my second comment. Zabbix 5.0.

[mdw]

After some more testing I have found that the testing facility invoked with the [Test] button doesn't apply the filter. *facepalm*