Getting a custom property to an action result query

Hello team,

I saw this relevance statement from a thread in this forum page (thank you to the owner, it is very helpful):

((id of it, name of it) of computer of it, (id of it, name of it, time issued of it, (if exists source fixlet of it then (if baseline flag of source fixlet of it then “baseline” else “fixlet”) else “action” )) of action of it) of results whose (status of it is bes action status failed) of bes actions whose (time issued of it > (now-7*day))

And I am thinking how I could include a condition for a custom property. We have a custom property called “Service Name” which is being manually tagged by creating a text file containing the machine’s service name.
image

From the relevance above, I tried adding it as:

((id of it, name of it) of computer whose (line 1 of file “C:\AT\ServiceName.txt” contains “Jump Host”), (id of it, name of it, time issued of it, (if exists source fixlet of it then (if baseline flag of source fixlet of it then “baseline” else “fixlet”) else “action” )) of action of it) of results whose (status of it is bes action status failed) of bes actions whose (time issued of it > (now-1*day))

…but it returns

Error: The operator “computer” is not defined.

I tried doing something like the one below instead to atleast get the custom property value

((id of it, name of it, (line 1 of file “C:\AT\ServiceName.txt”)) of computer of it, (id of it, name of it, time issued of it, (if exists source fixlet of it then (if baseline flag of source fixlet of it then “baseline” else “fixlet”) else “action” )) of action of it) of results whose (status of it is bes action status failed) of bes actions whose (time issued of it > (now-1*day))

…but it returns

Error: The operator “file” is not defined.

I feel like something is missing or wrongly grouped?

Thanks in advance for any advice.

Here we go, try this:

((id of it, name of it, value of results from (bes property "Service Name") of it) of computer of it, (id of it, name of it, time issued of it, (if exists source fixlet of it then (if baseline flag of source fixlet of it then "baseline" else "fixlet") else "action" )) of action of it) of results whose (status of it is bes action status failed) of bes actions whose (time issued of it > (now-7*day))

2 Likes

This is wondeful. It worked. thanks VK!

2 Likes