Capturing applicable computers for anaylses in session relevance

I’m performing queiries against the IEM api using the IBM Cloud Orchestrator IEM content pack, the content pack allows bespoke queries to be formulated but the responses (tuples) need to be returned in a standard 8 line format. I’m trying to get a list of computers in the format below returned for a query on a analysis.

    <Answer type="integer">32887827</Answer>
    <Answer type="string">UTILITY01</Answer>
    <Answer type="string">utility01.company.com</Answer>
    <Answer type="string">Win2003 5.2.3790</Answer>
    <Answer type="string">10.10.10.10;10.10.20.10</Answer>
    <Answer type="string">Fri, 13 Mar 2015 10:28:09 -0400</Answer>
    <Answer type="string"></Answer>
    <Answer type="string"></Answer>

For the sake of example, an Analysis is called ‘patching’ and there is a single computer applicable called ‘utility1’. I’ve tried many way of creating the query but cannot get a single tuple to return the information above.

Using similar topics in the forum, i’ve come up with the following, which doesnt work.
(((id of it, name of it | “”, hostname of it | “”, operating system of it | “”,(if(exists ip addresses of it) then (concatenations “;” of (ip addresses of it as string)) else ("")),last report time of it as string,value of client setting whose (name of it =“sco_piid”) of it | “”,value of client setting whose (name of it =“sco_vmid”) of it | “”) of results from (bes fixlets whose (name of it = “patching” and analysis flag of it = true)) of applicable computers of bes fixlets whose (name of it as lowercase = “patching”)

Any help greatly appreciated.

After a day of trying, I managed to get this working. For anyone interested the query was:

(id of it, name of it | “”, hostname of it | “”, operating system of it | “”,(if(exists ip addresses of it) then (concatenations “;” of (ip addresses of it as string)) else ("")),last report time of it as string,value of client setting whose (name of it =“sco_piid”) of it | “”,value of client setting whose (name of it =“sco_vmid”) of it | “”) of applicable computers of bes fixlets whose (analysis flag of it and name of it as lowercase = “patching”)

2 Likes