I’m trying to put together a session relevance query that will return the computer name of the newest computer added to Bigfix of a particular hardware serial number.
If a computer for example gets re-imaged, there will be two entries in Bigfix referring to that physical computer, with the same hardware serial number, but with different Bigfix ID’s. I’m interested only in returning the newest entry in Bigfix for each physical computer.
It seems that for any group of Bigfix entries relating to the same physical computer, the entry with the largest Computer ID is the newest one. So this query returns the Computer ID of the newest computer of a particular hardware Serial Number (e.g. C02KHBDHDRVC) in Bigfix:
maximum of ((values of results from (bes property whose (name of it = “Computer ID”)) of computers of results whose (exists values whose (it contains “C02KHBDHDRVC”) of it) of BES Property “Serials”) as integer)
And this query, I’ve discovered, will return the name of the computer that has a particular Computer ID (e.g. 913793):
name of computer of results whose (exists values whose (it contains “913793”) of it) of BES Property “Computer ID” as string
So how would I combine the two statements into one query, that will return the name of the newest computer in Bigfix for a given hardware serial number?
So it sounds like the serial number stays the same, but the computer name may change, so you are looking for the newest computer record for computers with the same serial number.
The other option is to look at the last report time instead of the computer ID, but you are correct that the computer IDs should be sequential, so either should be an indicator of which is the newest.
You should be able to do this with single recursion, but it may not be the most efficient way to do this. Also, part of your issue may be mitigated by automatically deleting old computer records.
Try This:
name of computer of results whose (exists values whose (it as integer = (
maximum of ((values of results from (bes property whose (name of it = “Computer ID”)) of computers of results whose (exists values whose (it contains “C02KHBDHDRVC”) of it) of BES Property “Serials”) as integer)
)) of it) of BES Property “Computer ID” as string
Also, given that this is session relevance, you might be better off posting in the WebReports forum, which deals more with session relevance. The fixlet authoring forum usually deals with non-session relevance and actionscript issues. It does not hurt to try one, and then the other though.
Thanks so much for your suggestion. I think I tried this already, and I’m getting a timeout error, which is not very informative of what’s going wrong or how to fix it. Any ideas?
It may be that the relevance is correct, just very inefficient. Session relevance often requires a different way of doing things because of inefficiency problems, and I am not used to dealing with it. I would recommend posting this question to the WebReports forum with a link back to this post.
What is it you are trying to do? Why not just eliminate duplicate computer records in the first place?
I’m integrating Bigfix information (such as hardware states, configuration, etc.) about computer assets into another system. The other system has the hardware serial numbers of each asset, so I’m using this serial number as the identifier to query Bigfix via the SOAP API. If a machine is re-imaged (as often happens within our IT department), obviously there will be two records in Bigfix for that particular serial number. I want to ensure that only one Bigfix computer is returned per Bigfix query of a particular hardware serial number, and of course the newest entry in Bigfix is the one we want. Yes, I could run that tool to eliminate duplicate computer records based on Serial, but there are a couple reasons not to:
It might be useful to other Bigfix admins to see a computer’s recent history, if it has been re-imaged for example, and who was last using it. It certainly has been useful to me several times.
If a computer is re-imaged before the next secheduled duplicate removal task, we’d still be faced with the same problem.
Could you just return both records to the system that is going to ingest them, and have it sort it out on that end? Perhaps it could even combine the results, preferring the most recent values.
I don’t know how to write relevance in such a way as to avoid the single recursion that is happening in the way I combined them. When doing client relevance this is usually less of an issue, even though there is still a penalty. I’d love to know how to get around the problem as well.
Could you just return both records to the system that is going to ingest them, and have it sort it out on that end? Perhaps it could even combine the results, preferring the most recent values.
I could, but it would probably be tricky/messy and so far I’ve been able to get Bigfix do all the tricky work so all that needs to be done outside of Bigfix is simple field-to-field mapping. I’m really hoping I don’t have to resort to that, and one would imagine such ability would be very helpful or necessary in other scenarios. If I get an an answer I’ll make sure to let you know! Thanks James!