Filter out systems not reporting in for 30 days

Content Authoring
1

I’m trying to modify this relevance query to filter out any systems that have not reported into bigfix in 30 days:

<table border="all">
<?relevance 
concatenation "%0a" of trs of (
  td of (id of computer of it as string & id of fixlet of it as string) & 
  td of (id of computer of it as string) & 
  td of (if exists name of computer of it then name of computer of it else "<none>") & 
  td of (if exists operating system of computer of it then operating system of computer of it else "<none>") & 
  td of (if exists ip addresses of computer of it then concatenations (html "<br>") of (ip addresses of computer of it as string) else html "") & 
  td of (if exists last report time of computer of it then (((year of it as string & "/" & month of it as two digits & "/" & day_of_month of it as two digits) of date (local time zone) of it & " " & (two digit hour of it as string & ":"   & two digit minute of it as string & ":" & two digit second of it as string) of time (local time zone) of it) of last report time of computer of it) else ("<none>")) & 
  td of (if (remediated flag of it or relevant flag of it) then ("1") else ("0")) & 
  td of (if (remediated flag of it) then "1" else "0") & 
  td of (if (relevant flag of it) then "1" else "0")) 
of
 ( 
  results (
       item 0 of it
      ,  elements of item 1 of it
      ) whose (remediated flag of it or relevant flag of it)
)
of 
(
    /* unwrap the set of fixlets */
   elements of item 0 of it
    /* the set of bes computers in which we are interested */
 , item 1 of it
)  
of
(
  set of fixlets whose (
     
     	(category of it = "Security Update" OR category of it = "Security Hotfix") AND
         Source Severity of it as lowercase contains "critical" AND 
         name of it as lowercase does not contain "superseded"
)
    	 of bes sites whose(name of it is contained by "Enterprise Security|Updates for Windows Applications")
, member set of bes computer groups whose (name of it starts with "Production")
)
?>
</table>

I was hoping I would be able to do it here but no such luck. I would appreciate any help.

, member set whose (now - last report time of it < 30*day) of bes computer groups whose (name of it starts with “Production”)

Thank you!

2

Hi LouC,

That filter is probably easiest to add to the elements in the ‘results’ part:

 ( 
  results (
       item 0 of it
      ,  elements whose (last report time of it > now - 30*day) of item 1 of it
      ) whose (remediated flag of it or relevant flag of it)
)

also, you probably want to pluralize that last line to ‘member sets’ for safety (it failed on my test env without it)

, member sets of bes computer groups whose (name of it starts with "Endpoints")

-hp3

3

thanks! That works as expected. I appreciate the help (and tip regarding member sets)