Hello everyone,
I hope you’re all doing well.
I’d like to know if anyone here has experience using Session Relevance to retrieve all actions executed over a long period (for example, a full month).
Currently, I’m building a way to easily query and audit actions in my BigFix environment, regardless of the operator. I managed to get this working through the Presentation Debugger, and I’m quite satisfied with the results. I was able to export the data and convert it to an XLSX file without any issues.
However, my main goal is to take this a step further and automate the process — ideally generating this report on a recurring basis (weekly, biweekly, or monthly).
So my questions are:
-
Is it possible to automate this kind of Session Relevance query?
-
What approaches would you recommend for scheduling and exporting the results regularly?
Below is the relevance I’m currently using:
("Action ID,Parent ID,Type,Source Site,Issued By,Time Issed,Action State,Action Name,Computer Name,OS,All Target Groups,Status,Start Time,End Time,Exit Code";
("%22" & (id of action of it as string | "") & "%22," &
"%22" & (if (exists parent group of action of it) then (id of parent group of action of it as string) else "-") & "%22," &
"%22" & (if (exists parent group of action of it) then "Baseline Component" else if (exists member actions of action of it) then "Baseline (Parent)" else "Single Action") & "%22," &
"%22" & (if (exists source fixlet of action of it) then (name of site of source fixlet of action of it) else "Custom/ActionSite") & "%22," &
"%22" & (name of issuer of action of it | "Unknown") & "%22," &
"%22" & (time issued of action of it as string | "") & "%22," &
"%22" & (state of action of it as string | "") & "%22," &
"%22" & (name of action of it | "") & "%22," &
"%22" & (name of computer of it | "") & "%22," &
"%22" & (operating system of computer of it | "Unknown") & "%22," &
"%22" & (concatenation "; " of names of bes computer groups of computer of it) & "%22," &
"%22" & (status of it as string | "") & "%22," &
"%22" & (start time of it as string | "-") & "%22," &
"%22" & (end time of it as string | "-") & "%22," &
"%22" & (exit code of it as string | "-") & "%22")
of results of bes actions
whose (time issued of it >= ("01 Feb 2026 00:00:00 -0300" as time)
AND time issued of it <= ("28 Feb 2026 23:59:59 -0300" as time)))
Any insights, best practices, or even alternative approaches would be greatly appreciated.
Thanks in advance!