In all of these I think you’re mixing up where the ‘results’ get pulled.
What we’re trying to accomplish is to get to the construct
( result (bes computer, bes property) )
where only your computers of interest (the computer group members) and only the property you care about (the property you identified by name) are considered.
The reason we use the ‘set’ instead of ‘members’, is to avoid a real performance penalty in looking up the property. If we used
(bes computers, bes properties whose (name of it = "Something") )
…then creating that tuple will create a loop where the ‘bes property’ lookup - the search among all properties to find the one with this name - is repeated for every computer in your environment.
By using the ‘bes computer set’ type, well…a set is one single thing, so the property lookup only happens once. Then in the next step that existing, already-looked-up property is used to retrieve results, instead of having to search for the property again.
I try to do just one thing at each step. It may make the query a little bit longer (in terms of number of lines), but I think it’s much more readable that way and more clear what’s happening. Starting from the end and working our way forward, we want to filter as early as possible.
(
name of item 0 of it
, last report time of item 0 of it
, concatenation ";" of values of results
(
item 0 of it /* bes computer */
, item 1 of it /* bes property */
)
)
of
(
elements whose (now - last report time of it < 1 * day) of item 0 of it /* filter bes computer by report time */
, elements of item 1 of it /* bes property */
)
of
(
member set of bes computer group whose (name of it = "BigFix Infrastructure") /* set of bes computers */
, set of bes properties whose (name of it as lowercase = ("Pending Restart - PendingFileRenameOperations (Windows)") as lowercase) /* property we care about */
)
We can’t filter on the ‘value’ until the very end, after everything as been looked up. I didn’t have an integer value to filter in my environment, but if you change the line
, concatenation ";" of values of results
to
, concatenation ";" of values whose (it as integer > 0 ) of results
I think that should do what you want.