Client Relevance to Find the Latest Action Details from An Endpoint

All,

I have been asked in the past by customers about actions running, and when the last action that ran, and when it ran. While we can always find that via session relevance, it can also be done on the client. I had borrowed some content in the past which was just taking the action with the largest actionid vs the last action run.

I had the pleasure of sitting with the illustrious @brolly33 recently and he got an initial query created, while I sat there drooling, giving me the last mile for a little bit of improvement on his filter. I was able to sit down and finish this, so I wanted to share it. It is for Windows Clients Only.

if (windows of operating system) then (((preceding texts of first ":" of it as integer, (parenthesized part of matches (regex "ast=(\d*)") of it| "0") as integer * second + ("01 Jan 1970 00:00:00" as local time), (parenthesized part of matches (regex "lat=(\d*)") of it | "0") as integer * second + ("01 Jan 1970 00:00:00" as local time)) of (rows of statement "Select state from ACTION_STATE_HISTORY where state like '%25ast%25' order by substr(state,instr(state,':ast=')+5,instr(state,':lal=')-instr(state,':ast=')-5) desc limit 1" of sqlite database of file "ActionHistory.db" of folder "__Global" of data folder of client as string)) as string) else "Not Windows"

`

Enjoy!!

3 Likes

Both Single and Double Quotes Appear to be unstyled now ...

Really enjoy now!!

3 Likes

I’m not sure what about this is windows only. It might need some tweaks, but this should theoretically work on all clients.

I made some tweaks for my preferences, but didn’t change the functionality, other than having it give 10 actions instead of 1:

( /* ActionID */ (it as integer) of preceding texts of firsts ":" of it, /* ActionStartTime */ (it * second + ("01 Jan 1970 00:00:00" as local time)) of (it as integer) of (parenthesized part of matches (regex "ast=(\d*)") of it | "0"), /* Maybe LastActiveTime? */ (it * second + ("01 Jan 1970 00:00:00" as local time)) of (it as integer) of (parenthesized part of matches (regex "lat=(\d*)") of it | "0")) of (it as string) of rows of statements "Select state from ACTION_STATE_HISTORY where state like '%25ast%25' order by substr(state,instr(state,':ast=')+5,instr(state,':lal=')-instr(state,':ast=')-5) desc limit 10" of sqlite databases of files "ActionHistory.db" of folders "__Global" of data folders of clients

This definitely works on MacOS/Windows and I think should work elsewhere too.

Related:

2 Likes