Get bes properties with if property exists not showing all computers

Reporting
1

Hi,

I’m using the following query to get all properties if they exist or print “Null” if any doesn’t exist:
(
(if (exists result (item 0 of it, item 1 of it) and
exists values of result (item 0 of it, item 1 of it) )
then (concatenation “!” of values of result (item 0 of it, item 1 of it))
else (“Null”)),
(if (exists result (item 0 of it, item 2 of it) and
exists values of result (item 0 of it, item 2 of it) )
then (concatenation “!” of values of result (item 0 of it, item 2 of it))
else (“Null”)),
(if (exists result (item 0 of it, item 3 of it) and
exists values of result (item 0 of it, item 3 of it) )
then (concatenation “!” of values of result (item 0 of it, item 3 of it))
else (“Null”)),
(if (exists result (item 0 of it, item 4 of it) and
exists values of result (item 0 of it, item 4 of it) )
then (concatenation “!” of values of result (item 0 of it, item 4 of it))
else (“Null”)),
(if (exists result (item 0 of it, item 5 of it) and
exists values of result (item 0 of it, item 5 of it) )
then (concatenation “!” of values of result (item 0 of it, item 5 of it))
else (“Null”)),
(if (exists result (item 0 of it, item 6 of it) and
exists values of result (item 0 of it, item 6 of it) )
then (concatenation “!” of values of result (item 0 of it, item 6 of it))
else (“Null”)),
(if (exists result (item 0 of it, item 7 of it) and
exists values of result (item 0 of it, item 7 of it) )
then (concatenation “!” of values of result (item 0 of it, item 7 of it))
else (“XXX, 01 Jan 1900 00:00:00 /0000”))
)
of (
bes computers,
bes property “Computer Name”,
bes property “OS”,
bes property “IP Address”,
bes property “OS - Full Name”,
bes property “Location By IP Range”,
bes property “location”,
bes property “Last Report Time”
)

The problem is that I get a small amount of hosts with the name and properties, then a huge number of entries with all set to null.
If I use this query:
(name%20of%20it)%20of%20bes%20computers whose (exists name of it)

I get the exact number of computers.

I’m trying to understand why the main query is not giving all the computer names that exists and printing Null for almost all of them when the small query can actually print them out.
Any ideas?

Thanks,
Isaac

2

I’ve done some more testing and for a certain hostname I get two different results depending which query I use.
With the long query I get everything as null, but if I use this query, I get the correct values:
(
name of it,
values of property results whose (name of property of it = “OS”) of it,
(concatenations “!” of (values of it as string)) of property results whose (name of property of it = “IP Address”) of it
)
of bes computers whose (name of it = “Server1”)

Any ideas of what’s different and how can I get the values for the hostname using the long query with the if statements?

Thanks,
Isaac

3

Are you sure you’re getting the correct copies of each property? For instance if you have a duplicate property named “OS” from an Analysis, perhaps in your Operator Site or a Custom Site, you might be getting the wrong instance of the “OS” property.

If the errant analysis is relevant to only a small set of computers, you might get the small result set as you describe.

4

Hi Jason,
it may very well be that.
How can check that? should they have replicated names as fields in the webreports?

5

You could try to get a list of all properties matching your given property name. For example

ids of bes properties whose (name of it = "OS")

for me returns

2299641819, 5, 1

Referring to https://support.bigfix.com/inspectors/Session%20Objects_Any.html#bes property,“id of bes property” gives

Returns a 3-tuple of integers composed of the site ID, analysis ID and property ID. The first integer identifies the site hosting the Analysis. For custom properties not contained in an analysis (those created using the Manage Properties dialog), it is the ID of the Action site. The second integer indentifies the Analysis containing the property. For custom properties, this is 0. The third integer identifies the property itself. This is the same as the source ID if the property is defined in an Analysis. If it is not defined in an Analysis then this is the unique object ID for the property.

IF you get multiple ID’s returned for any of the property names you query, you could have this problem of multiple properties with the same name. Once you determine which of the properties you actually want to retrieve, you could query by the unique property ID’s, for example

value of result(bes computer whose (name of it as lowercase = "myhost"), bes property whose (id of it = (2299641819, 5, 1)))

Win2008R2 6.1.7601