How do I combine two relevance queries?

Content Authoring
1

Hi, just learning how this works. i am trying to search for two services.

if exists service “SepMasterService” then state of service “SepMasterService” Else “Not Install”

if exists service “Symantec AntiVirus” then state of service “Symantec AntiVirus” Elso “Not Install”

i am able to run only of them. Any help please.

2

I’m not sure how you want your output, but the following will return an answer for all specified strings:

q: (if (exists service (it)) then ((service name of it, state of it) of service (it)) else (it as string, "Not Installed")) of ("SepMasterService"; "Symantec AntiVirus")

If SepMasterService was an existing and running service and Symantec AntiVirus did not exist, it would output:

A: SepMasterService, Running
A: Symantec Antivirus, Not Installed
3

Let me dissect and explain how this works:

  • As you already know, the if-then-else has syntax if ({if-clause}) then ({then-clause}) else ({else-clause}).
  • I run the if-then-else against plurals shown as ("SepMasterService"; "Symantec AntiVirus"). In other words, ({run-this}) of ({on-me}; {and-me})

So, it’s running the if (exists service (it)) then ((service name of it, state of it) of service (it)) else (it as string, "Not Installed") against each item, SepMasterService and Symantec AntiVirus.

Hope this helps!

4

Thanks for your response, i tried that not reported as i though I have servers that have SepMasterService running and servers running Symantec AntiVirus, trying to see which servers are running or stopped

5

If you are querying directly on the machine, could you paste the output of the relevance at comment #2 using the Fixlet Debugger?

If you are using an analysis, then it’s probably better to break up the query (similar to like you did in the original post). You can add a Property for each query.

6

If each endpoint only has one of the services in question, then this should be what you are looking for:

states of (services "Symantec AntiVirus";services "SepMasterService")

This will return running or stopped depending on the state, or none if neither is installed.