Mean time to remediate?

(imported topic written by jnmoore91)

Hi All,

I’m curious how the mean time to remediate is calculated on the Fixlet Progress Report.

For the most part, this relevance expression seems to be accurate:

((last became nonrelevant of it) - (first became relevant of it)) of results whose (not relevant flag of it AND exists last became relevant of it) of (bes fixlets whose (name of it is “C - Apple QuickTime 7.6 Stand-Alone Player Available - Windows XP/2003/Vista”))

which returns a collection of time spans which is averaged to find the mean time to remediate, however, it works for some fixlets but not for others.

One exception I found was…

C - Apple QuickTime 7.6 Stand-Alone Player Available - Windows XP/2003/Vista
6 Computers Total. 16.67%
First detected: Wed, May 13, 2009 at 5:21:24 PM
Mean time to remediate: 5 days, 18 hours, 8 minutes, 29 seconds

Viewing the Fixlet reports revealed there is 5 computers affected and 1 remedied, so the relevance expression above should return one time span, which also represents the average. When I run the relevance expression above, the result is

18 days, 23:28:34

.

Could anyone explain the discrepancy to me, or help me improve the accuracy of my relevance expression?

–Jerroyd

(imported comment written by BenKus)

I think we use the last time the Fixlet was relevant rather than the first time it was relevant to do our mean time to remediate… to mirror the calculation you want to check the “last became relevant” as opposed to “first became relevant”:

((last became nonrelevant of it) - (last became relevant of it)) of results whose (not relevant flag of it AND exists last became relevant of it) of (bes fixlets whose (name of it is “C - Apple QuickTime 7.6 Stand-Alone Player Available - Windows XP/2003/Vista”))

Ben

(imported comment written by jnmoore91)

holy cow, it worked!

thanks again!

(imported comment written by hameyer91)

Ben,

Would it be safe to infer then that the Mean Time to Remediate as shown on the Web Reports Overview page is simply:

((last became nonrelevant of it) - (last became relevant of it)) of results whose (not relevant flag of it AND exists last became relevant of it) of bes fixlets

Or does it somehow take the Mean Time to Remediate for each Fixlet and average those values?

(imported comment written by BenKus)

Hi hameyer,

That is correct… Here is the session relevance that should produce the same result as the overview page:

(it as integer *second) of mean of (it/second) of ((last became nonrelevant of it) - (last became relevant of it)) of results whose ( exists last became nonrelevant of it AND exists last became relevant of it AND last became nonrelevant of it > last became relevant of it) of bes fixlets whose (globally visible flag of it AND Fixlet flag of it)

Ben

I am looking to see the amount of time it takes for machines to be remediated for a particular fixlet, would eventually like to see how long all fixlets within a site take as well.

I removed the mean calculation from the previous relevance, and included the id of a particular fixlet.

(it as integer *second) of mean of (it/second) of ((last became nonrelevant of it) - (last became relevant of it)) of results whose ( exists last became nonrelevant of it AND exists last became relevant of it AND last became nonrelevant of it > last became relevant of it) of bes fixlets whose (globally visible flag of it AND Fixlet flag of it AND id of it = 20161003)

I’m getting a number of date/time results, which I’m assuming are for individual machines. If this is true, how would I include the name of the machine with the date/time results.

Current results look like:

12 days, 16:46:35
14 days, 16:45:55

I’d like

machineA, 12 days, 16:46:35
machineB, 14 days, 16:45:55

Thanks,
Bob_K

@Bob_K, the main object that you are working with is BES Fixlet Results, which is of course each computer reporting on the results of its Fixlet evaluation.
To that end, we have access to the “computer” and “Fixlets” of the results.

Here is an example statement where you can pull in other properties as needed.

(
    name of computer of it,
    operating system of computer of it,
    name of fixlet of it,
    (last became nonrelevant of it) - (last became relevant of it)
) 
of results whose ( 
        exists last became nonrelevant of it AND 
        exists last became relevant of it AND 
        last became nonrelevant of it > last became relevant of it) 
of bes fixlets whose (
        globally visible flag of it AND 
        Fixlet flag of it AND 
        id of it = 20161003)