✄𐘗
text code block:
✄𐘗`cisco_ios`
facility IN ("HA_EM", "VMAN", "IM", "AAA")
mnemonic IN ("LOG", "ACTIVATION_STATE", "IOX_INST_INFO", "INSTALL_STATE", "AAA_ACCOUNTING_MESSAGE")
message_text IN (
    "*guestshell enable*",
    "*guestshell destroy*",
    "*Successfully activated virtual service 'guestshell*",
    "*IOX SERVICE guestshell*",
    "*Destroying virtual service 'guestshell*",
    "*Successfully destroyed virtual service 'guestshell*"
)
| eval dest=coalesce(host, dvc, dest, "unknown")
| eval event_type=case(
    like(message_text, "%guestshell enable%"), "guestshell_enable_command",
    like(message_text, "%guestshell destroy%"), "guestshell_destroy_command",
    like(message_text, "%Successfully activated virtual service 'guestshell%"), "vman_guestshell_activated",
    like(message_text, "%IOX SERVICE guestshell%"), "im_iox_guestshell_activated",
    like(message_text, "%Destroying virtual service 'guestshell%"), "vman_guestshell_destroying",
    like(message_text, "%Successfully destroyed virtual service 'guestshell%"), "vman_guestshell_destroyed",
    true(), "other"
)
| bin _time span=30m
| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(event_type) as event_types
              values(message_text) as message
by _time dest
| where
        (
            mvfind(event_types, "vman_guestshell_activated") >= 0
            OR
            mvfind(event_types, "im_iox_guestshell_activated") >= 0
            OR
            mvfind(event_types, "guestshell_enable_command") >= 0
        )
        AND
        (
            mvfind(event_types, "vman_guestshell_destroying") >= 0
            OR
            mvfind(event_types, "vman_guestshell_destroyed") >= 0
            OR
            mvfind(event_types, "guestshell_destroy_command") >= 0
        )
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_ios_xe_guestshell_activation_and_destroy_filter`