I am trying to combine the two relevance statements below, but keep getting tripped up by “A singular expression is required”. I only want to look at Javaw.exe with the path c:\program file (x86)\java\jre.
image paths of instances of application usage summaries “javaw.exe”
last time seen of application usage summary “javaw.exe” <= (now - 30*day)
I’m not sure what you’re trying to do with that second statement - return a True/False for whether such instances exist have been unused for 30 days, or retrieve a list of those unused ones. I don’t use Java regularly, but I do have multiple instances of Python that I run, so where are some samples based on python.exe.
One key is that application usage summary "javaw.exe" can return multiple application usage summary instance results, and each instance can have its own ‘last seen time’; where the last seen time of application usage summary will be the greatest of any of its instances. So we’d probably need to filter by both Path and Last Time Seen on each instance, below are examples of each.
It’s also probably useful to note that if the java.exe has never been executed, it shouldn’t have a summary or instance, so we may need to reverse the filter so we check for ‘no instances exist within the last 30 days’ rather than ‘all instances are more than 30 days old’
Q: (image paths of it, last times seen of it) of instances of application usage summaries "python.exe"
A: C:\Program Files\Python37\python.exe, ( Thu, 28 Jul 2022 10:11:24 -0500 )
A: C:\Python39\python.exe, ( Mon, 15 Aug 2022 18:20:01 -0500 )
A: C:\Users\jason.walker\Documents\GitHub\bes-content\API\Python Short Examples\samples-environment\Scripts\python.exe, ( Mon, 23 Aug 2021 13:52:38 -0500 )
A: C:\Users\jason.walker\production-environment\Scripts\python.exe, ( Thu, 28 Jul 2022 10:12:59 -0500 )
A: C:\Users\jason.walker\.cache\pre-commit\repojr1qo307\py_env-python3.9\Scripts\python.exe, ( Thu, 16 Jun 2022 11:22:08 -0500 )
A: C:\Users\jason.walker\py-win32-env\Scripts\python.exe, ( Wed, 27 Jul 2022 20:37:48 -0500 )
A: C:\Users\jason.walker\.cache\pre-commit\repobrvm41fh\py_env-python3.9\Scripts\python.exe, ( Thu, 11 Aug 2022 16:12:18 -0500 )
A: C:\GitHub\virtualenv\virtualenv-autopkg\Scripts\python.exe, ( Mon, 15 Aug 2022 18:20:01 -0500 )
A: C:\Users\jason.walker\.cache\pre-commit\repokjekrk47\py_env-python3.9\Scripts\python.exe, ( Tue, 02 Aug 2022 12:18:26 -0500 )
A: C:\Users\jason.walker\.cache\pre-commit\repoymhg2xz3\py_env-python3.9\Scripts\python.exe, ( Tue, 02 Aug 2022 12:22:47 -0500 )
A: C:\Users\jason.walker\.cache\pre-commit\repocsryyee2\py_env-python3.9\Scripts\python.exe, ( Tue, 02 Aug 2022 12:28:20 -0500 )
A: C:\Users\jason.walker\.cache\pre-commit\repoiv3pk869\py_env-python3.9\Scripts\python.exe, ( Thu, 11 Aug 2022 16:03:38 -0500 )
A: C:\GitHub\virtualenv\api-demo-environment\Scripts\python.exe, ( Wed, 10 Aug 2022 09:42:58 -0500 )
Q: (image paths of it, last times seen of it) of instances whose (now - last time seen of it < 10 * day) of application usage summaries "python.exe"
A: C:\Python39\python.exe, ( Mon, 15 Aug 2022 18:20:01 -0500 )
A: C:\Users\jason.walker\.cache\pre-commit\repobrvm41fh\py_env-python3.9\Scripts\python.exe, ( Thu, 11 Aug 2022 16:12:18 -0500 )
A: C:\GitHub\virtualenv\virtualenv-autopkg\Scripts\python.exe, ( Mon, 15 Aug 2022 18:20:01 -0500 )
A: C:\Users\jason.walker\.cache\pre-commit\repoiv3pk869\py_env-python3.9\Scripts\python.exe, ( Thu, 11 Aug 2022 16:03:38 -0500 )
A: C:\GitHub\virtualenv\api-demo-environment\Scripts\python.exe, ( Wed, 10 Aug 2022 09:42:58 -0500 )
Q: (image paths of it, last times seen of it) of instances whose (now - last time seen of it < 10 * day and image path of it as lowercase does not contain ".cache" as lowercase) of application usage summaries "python.exe"
A: C:\Python39\python.exe, ( Mon, 15 Aug 2022 18:20:01 -0500 )
A: C:\GitHub\virtualenv\virtualenv-autopkg\Scripts\python.exe, ( Mon, 15 Aug 2022 18:20:01 -0500 )
A: C:\GitHub\virtualenv\api-demo-environment\Scripts\python.exe, ( Wed, 10 Aug 2022 09:42:58 -0500 )
T: 2695
Q: exists instances whose (now - last time seen of it < 10 * day and image path of it as lowercase does not contain ".cache" as lowercase) of application usage summaries "python.exe"
A: True
For a repeatable query where we can feed the pathname of a file as an input, I built this query - “Has this specific executable file been unused for 60 days”
Consider three cases - “xcopy.exe” has never been used, “wscript.exe” has been used but two years ago, and “python.exe” has been used recently -
Q: (image paths of it, last times seen of it) of instances of application usage summaries "xcopy.exe"
T: 359
Q: ((image paths of it, last times seen of it) of items 0 of (instances of application usage summaries (name of it), pathname of it) whose (image path of item 0 of it as lowercase = item 1 of it as lowercase)) of file "C:\Windows\System32\wscript.exe"
A: C:\Windows\System32\wscript.exe, ( Wed, 15 Jul 2020 11:05:49 -0500 )
Q: not exists it whose (now - item 1 of it < 60 * day) of ((image paths of it, last times seen of it) of items 0 of (instances of application usage summaries (name of it), pathname of it) whose (image path of item 0 of it as lowercase = item 1 of it as lowercase)) of file "C:\Windows\System32\xcopy.exe"
A: True
Q: not exists it whose (now - item 1 of it < 60 * day) of ((image paths of it, last times seen of it) of items 0 of (instances of application usage summaries (name of it), pathname of it) whose (image path of item 0 of it as lowercase = item 1 of it as lowercase)) of file "C:\Windows\System32\wscript.exe"
A: True
Q: not exists it whose (now - item 1 of it < 60 * day) of ((image paths of it, last times seen of it) of items 0 of (instances of application usage summaries (name of it), pathname of it) whose (image path of item 0 of it as lowercase = item 1 of it as lowercase)) of file "C:\GitHub\virtualenv\virtualenv-autopkg\Scripts\python.exe"
A: FalseThanks Jason! I have been chewing on the code all day trying to get it working for me with Oracle Java.
Your last statement does not work because it needs to check for existence of the file, and the usage data may exist for the file, but not the correct path.
Here is what I ended up with that seems to work to find all Oracle Java installs that have not been used in the last 10 days. I am sure there is a more elegant way to write it.
exists keys whose (value "DisplayName" of it as string as lowercase contains "java" AND (value "Publisher" of it as string as lowercase contains "oracle" OR value "Publisher" of it as string as lowercase contains "sun") AND value "DisplayName" of it as string as lowercase does not contain "java auto updater" AND value "DisplayName" of it as string as lowercase does not contain "java 8 update 199") of keys "hklm\software\microsoft\windows\currentversion\uninstall" of (native registry;registry)
AND
(if exists instances whose (image path of it as lowercase contains "\java\jre1.8.0_202\bin\java.exe") of application usage summaries "java.exe" then exists instances whose (now - last time seen of it > 10 * day and image path of it as lowercase starts with "c:\program files (x86)\java\jre1.8.0_202\bin\java.exe") of application usage summaries "java.exe" else true)
AND
(if exists instances whose (image path of it as lowercase contains "\java\jre1.8.0_202\bin\javaw.exe") of application usage summaries "javaw.exe" then exists instances whose (now - last time seen of it > 10 * day and image path of it as lowercase starts with "c:\program files (x86)\java\jre1.8.0_202\bin\javaw.exe") of application usage summaries "javaw.exe" else true)
AND
(if exists instances whose (image path of it as lowercase contains "\java\jre1.8.0_202\bin\javaws.exe") of application usage summaries "javaws.exe" then exists instances whose (now - last time seen of it > 10 * day and image path of it as lowercase starts with "c:\program files (x86)\java\jre1.8.0_202\bin\javaws.exe") of application usage summaries "javaws.exe" else true)
AND
(if exists instances whose (image path of it as lowercase contains "\java\jre1.8.0_202\bin\jp2launcher.exe") of application usage summaries "jp2launcher.exe" then exists instances whose (now - last time seen of it > 10 * day and image path of it as lowercase starts with "c:\program files (x86)\java\jre1.8.0_202\bin\jp2launcher.exe") of application usage summaries "jp2launcher.exe" else true)