Conditional Session Relevance

Reporting
1

Hello,

Is there any way to return the time issued of the action in case that that start time isn’t available? I would like something like this but I am having issues coming up with the correct relevance:

( (name of computer of it as string), (start time of it as string | time issued of action of it as string) ) of results of bes actions

I am trying to find a way to access the action object inside of the tuple.

2

Time issued is of action, not of result: https://developer.bigfix.com/relevance/reference/bes-action.html#time-issued-of-bes-action-time

You are effectively trying to get a result like this:

number of times issued of results of bes actions

which gives the error:

Error: The operator "times issued" is not defined.

You would instead do something like this:

(start time of item 0 of it | item 1 of it) of (results of it, times issued of it) of bes actions

Then putting it all back together:

(names of computers of items 1 of it, items 0 of it) of (start time of item 0 of it | item 1 of it, items 0 of it) of (results of it, times issued of it) of bes actions

And probably more helpful:

(names of computers of items 1 of it, items 0 of it, names of actions of items 1 of it) of (start time of item 0 of it | item 1 of it, items 0 of it) of (results of it, times issued of it) of bes actions
2 Likes
3

Thank you so much for the response this helps! I ran the query below:

Q: (names of computers of items 1 of it, items 0 of it) of (start time of item 0 of it | item 1 of it, items 0 of it) of (results of it, times issued of it) of bes actions

A: AA-BBB, ( Mon, 09 Dec 2019 00:05:25 -0600 )
A: AA-CCC, ( Sun, 17 May 2020 22:59:08 -0600 )

Would it possible to change the relevance to return the date as a single item instead of a single tuple? Something like this:

A: AA-BBB, Mon, 09 Dec 2019 00:05:25 -0600

1 Like
4

You would cast it as a string and concatenate it

Something like this:

( concatenations ", " of (item 0 of it as string; following text of first ", " of (item 1 of it as string); item 2 of it as string) of it ) of (names of computers of items 1 of it, items 0 of it, names of actions of items 1 of it) of (start time of item 0 of it | item 1 of it, items 0 of it) of (results of it, times issued of it) of bes actions

Another option to collapse a tuple into a tuple string is just cast the entire tuple as a string:

(it as string) of (names of computers of items 1 of it, items 0 of it, names of actions of items 1 of it) of (start time of item 0 of it | item 1 of it, items 0 of it) of (results of it, times issued of it) of bes actions

If you are doing this for display purposes, then in most cases this is already implied.

1 Like