I’ve been trying to pound this out for a while now.
Essentially, what we want to do is take every fixlet for every endpoint that has become relevant in the last 30 days in it’s own line. Those lines would include pertinent information such as ip address, computer name, etc.
Each piece of information will be separated by a pipe “|”.
For clarification, I’ve put together the following pseudo code:
(ip address of bes computers) &
"|" & (names of bes computers) &
"|" & =====username==== &
"|" & (values of results (bes property
"_AgencyID", bes computers)) &
"|" & (
if (value of result (bes property
"Laptop Check (Universal)", bes computers)) =
"True" then
"Laptop"
else
if (operating system of bes computer) contains
"Win2" then
"Server"
else
"Desktop") &
"|" & (id of fixlet of results of bes fixlets) &
"|" & (name of fixlet of of results of bes fixlets) &
"|" & (category of fixlet of results of bes fixlets) &
"|" & (last became relevant of results of bes fixlets)
I still need clarification as to what the
====username===
section will be but if anyone could help with the rest I’m sure I’d be able to figure it out.
Here is an example that you can work from, but beware that the query will return a lot of results and will be very slow. It is best to first try with a small set of computers, and a small number of Fixlets. I have used Patches for Windows as an example, but you should probably go smaller.
( name of computer of it, concatenations
"; " of (ip addresses of computer of it as string), values of results from (bes property whose (name of it =
"User Name")) of computer of it, id of fixlet of it as string, name of fixlet of it, last became relevant of it ) of results ( bes computers, bes fixlets whose (display name of site of it =
"Patches for Windows (English)")) whose (relevant flag of it and (now - last became relevant of it) < 30 * day )
It seems to give good results on my test server, but in production it gives one result and then immediately after that first result I get the following error:
{code}Singular expression refers to non-unique object.{/code}
( concatenations
"; " of (ip addresses of computer of it as string), name of computer of it, values of results from (bes property whose (name of it =
"User Name")) of computer of it, values of results from (bes property whose (name of it =
"_AgencyID")) of computer of it, values of results from (bes property whose (name of it =
"Endpoint Role")) of computer of it, id of fixlet of it as string, name of fixlet of it, category of fixlet of it, source severity of fixlet of it, last became relevant of it ) of results ( bes computers, bes fixlets whose (display name of site of it contains
" ")) whose (relevant flag of it and (now - last became relevant of it) < 30 * day )
In developement (version 8.2.1093.0)it gives us quite a few results and then ends in
Singular expression refers to non-unique object.
In production (version 8.1.551.0) it gives us one line of results (a complete line, nothing is missing) and appends immediately to the end
Oh I should also add that I had separate lines if the User Name field had multiple results. As such I had to change it to:
(
if (it contains
";") then (preceding text of first
";" of it)
else it) of (concatenation
";" of values of (results (it, bes property whose (id of it = (2147495638,22,1))))) of computer of it,