Try the Web Reports QNA page Web Reports QnA or the Console Presentation Debugger Open the BigFix Console Presentation Debugger
queries:
q: number of bes actions
q: number of bes action results
That should give us an idea of how this needs to scale.
To test the query itself, we can use the Console Debugger - with the caveat that there is no way to stop the query running. If you trigger a query that takes too long / uses too much memory, it could grow in memory until it crashes the Console, with no way to abort it outside of killing the Console process. Make sure any editing you do in the background is saved before using the Console Debugger to run these queries, and if you are making complex queries be sure to copy them off to a notepad.
Here’s what I was running to check the correctness of the query -
table of concatenation of trs of
(
concatenation "%0a" of (td of item 0 of it; td of item 1 of it; td of item 2 of it; td of item 3 of it;td of item 4 of it; td of item 5 of it; td of item 6 of it;td of item 7 of it;td of item 8 of it; td of item 9 of it; td of item 10 of it; td of item 11 of it)
) of
(
(
id of computer of it as string
, link of computer of it | "No Name" as html
, (if group member flag of action of it then link of parent group of action of it else "no parent" as html)
, id of action of it as string
, link of action of it
, name of issuer of action of it
, time issued of action of it as string
, state of action of it as string
, status of it as string
, exit code of it as string | "no exit code"
, end time of it as string | "no end time"
, cve id list of source fixlet of action of it as string| "no CVE"
) of results of it
;
(
if (exists targeted computer set of it) then /* retrieve properties for non-reported computer results */
(
id of item 0 of it as string /* non-reported computer id */
, link of item 0 of it | "<computer deleted>" as html
, (if group member flag of item 1 of it then link of parent group of item 1 of it else "" as html) | "" as html
, id of item 1 of it as string
, link of item 1 of it | "" as html
, name of issuer of item 1 of it | "no issuer"
, time issued of item 1 of it as string
, state of item 1 of it as string
, "Not Reported"
, "no exit code" /* exit code */
, "no end time" /* end time */
, cve id list of source fixlet of item 1 of it | "no CVE"
) of (elements of (targeted computer set of it - reported computer set of it), it ) else nothing
) of it
)
of bes actions