Bigfix action query

how can i do a relevnce query of action to get the name and the id and the status of action and the “exit code” of action?

Hi, It would be easier to answer your question if you add some context.

Do you want to query the endpoint for this? or do you want to query the BigFix database with session relevance?

If it’s session relevance then the query should be fairly straight forward, however you will need to specify how you mean to filter on a specific action or computer etc. Basically, what exact problem/use case are you trying to solve?

Basic start to your session relevance query could be:

Q: (name of it, id of it) of bes actions

Hello iftachzi,

This might be a starting point for you:

( id of it as string, name of it, name of issuer of it, (if exists (names of sites of source fixlets of it) then name of site of source fixlet of it else ""), time issued of it as string, (if exists expiration time of it then expiration time of it as string else ""), concatenation ";" of (multiplicity of it as string & " " & it & " ") of unique values of (statuses of results of it as string) ) of bes actions

Regards,
Vitaliy

1 Like

image

i meant to this, to get this one

@vnovik

(
name of computer of it ,
"Multiple Action Group" & name of parent group of action of it ,
 name of action of it ,
 status of it as string | "na" , 
 start time of it as string | "na" , 
 end time of it as string | "na" , 
 (end time of it - start time of it) as string | "na" , 
 detailed status of it as string | "na" , 
 exit code of it as string | "no exit code" , 
 retry count of it
) 
of results of member actions of bes actions; 
(
name of computer of it ,
"Single Action" , 
name of action of it , 
status of it as string | "na" , 
start time of it as string | "na" , 
end time of it as string | "na" , 
(end time of it - start time of it) as string | "na" , 
detailed status of it as string | "na" ,
exit code of it as string | "no exit code" , 
retry count of it
) 
of results of bes actions 

Regards,
Vitaliy

1 Like


this what i get=\ sorry about the snooze=/

@vnovik

Where did you run this relevance?

Looks like you’re running this in Excel Connector.

Either way, since you got Singular expression refers to nonexistent object here is the same relevance with some added error handling in cases where Computer Names or Retry Counts may be missing:

(
name of computer of it | "na",
"Multiple Action Group" & name of parent group of action of it ,
 name of action of it ,
 status of it as string | "na" , 
 start time of it as string | "na" , 
 end time of it as string | "na" , 
 (end time of it - start time of it) as string | "na" , 
 detailed status of it as string | "na" , 
 exit code of it as string | "no exit code" , 
 retry count of it as string | "na"
) 
of results of member actions of bes actions; 
(
name of computer of it | "na",
"Single Action" , 
name of action of it , 
status of it as string | "na" , 
start time of it as string | "na" , 
end time of it as string | "na" , 
(end time of it - start time of it) as string | "na" , 
detailed status of it as string | "na" ,
exit code of it as string | "no exit code" , 
retry count of it as string | "na"
) 
of results of bes actions

@Aram

hey, sorry about the question but i need to replace it with my action?
this :
Multiple Action Group
Single Action

or just run it like that

You can run it as is. The ‘Multiple Action Group’ vs. ‘Single Action’ field refers to the type of action in the results.

@Aram

if i run it as is im getting error=\