API - filter bes property results by bes computer group

Content Authoring
1

I have a property which returns results from all computers, but when I query those computers with the API I cannot figure out how to filter out by computer group.

This gets me ALL of the computers where value > 0.

(names of computers of it) of results whose (value of it as integer > 0 and now - last report time of computer of it < 2 * hour) of bes property “my_custom_property”

But I want to filter out only those in a group also.

names of members of bes computer group whose (name of it = “my group”)

2

This post is the go-to reference on querying computer properties (efficiently, with great error-handling) Efficient Session Relevance Query for Computer Properties

Just replace ’set of bes computers' with ’member set of bes computer group whose ()'

3

I’m pretty close but must be missing something. This returns all computers where “my property” > 0 and filters by computer name.

(
name of item 0 of it
, (concatenation “;” of values of results (item 0 of it, elements of item 1 of it))
)
of
(
elements of item 0 of it
,item 1 of it
) of
(
set of bes computers whose (name of it contains “882” AND (concatenation of values of results (it, bes properties “my_property”) as integer > 0))
, set of bes properties whose (name of it as lowercase = (“my_property”) as lowercase)
)

But when I try and switch it to “member set of bes computer group” I get “Error: The operator “results” is not defined.” and I can’t figure out why.

(
name of item 0 of it
, (concatenation “;” of values of results (item 0 of it, elements of item 1 of it))
)
of
(
elements of item 0 of it
,item 1 of it
) of
(
member set of bes computer group whose (name of it = “group name” AND (concatenation of values of results (it, bes properties “my_property”) as integer > 0))
, set of bes properties whose (name of it as lowercase = (“my_property”) as lowercase)
)

But if I take the “my_property” > 0 filter out then the member set of bes computer group works.

(
name of item 0 of it
, (concatenation “;” of values of results (item 0 of it, elements of item 1 of it))
)
of
(
elements of item 0 of it
,item 1 of it
) of
(
member set of bes computer group whose (name of it = “group name”)
, set of bes properties whose (name of it as lowercase = (“my_property”) as lowercase)
)

4

In all of these I think you’re mixing up where the ‘results’ get pulled.

What we’re trying to accomplish is to get to the construct

( result (bes computer, bes property) )

where only your computers of interest (the computer group members) and only the property you care about (the property you identified by name) are considered.

The reason we use the ‘set’ instead of ‘members’, is to avoid a real performance penalty in looking up the property. If we used

(bes computers, bes properties whose (name of it = "Something") )

…then creating that tuple will create a loop where the ‘bes property’ lookup - the search among all properties to find the one with this name - is repeated for every computer in your environment.

By using the ‘bes computer set’ type, well…a set is one single thing, so the property lookup only happens once. Then in the next step that existing, already-looked-up property is used to retrieve results, instead of having to search for the property again.

I try to do just one thing at each step. It may make the query a little bit longer (in terms of number of lines), but I think it’s much more readable that way and more clear what’s happening. Starting from the end and working our way forward, we want to filter as early as possible.

(
 name of item 0 of it
 , last report time of item 0 of it
 , concatenation ";" of values of results 
  (
  item 0 of it /* bes computer */
  , item 1 of it /* bes property */
  )
)
of
  (
  elements whose (now - last report time of it < 1 * day) of item 0 of it /* filter bes computer by report time */
  , elements of item 1 of it /* bes property */
  )

 of
(
  member set of bes computer group whose (name of it = "BigFix Infrastructure") /* set of bes computers */
, set of bes properties whose (name of it as lowercase = ("Pending Restart - PendingFileRenameOperations (Windows)") as lowercase)  /* property we care about */ 
)

We can’t filter on the ‘value’ until the very end, after everything as been looked up. I didn’t have an integer value to filter in my environment, but if you change the line

, concatenation ";" of values of results

to

, concatenation ";" of values whose (it as integer > 0 ) of results

I think that should do what you want.

2 Likes