Multiple analysis with same properties names?

Content Authoring
1

We have two operating systems where we do some checks and report it back using two separate analysis.
We were running first analysis for some time and we see results without problem when we use eg.
(hostname of it, value of results from (bes properties \"Asset Owner\") of it) of bes computers whose (hostname of it as lowercase contains \"test-computer\" | \"false\").

Then we have added second OS. We have modified the first analysis to target just the first OS and created second analysis targeting second OS using same properties names (so we can keep using same reporting).

Now when I try to use the relevance above it does not report anything for computers using the second OS as if there are no properties set for them (Singular expression refers to nonexistent object.) however if I simply try to pull out all the properties for any such computer using (names of properties of it, values of it) of property results of bes computers whose (hostname of it contains "second-os-computer") then I see the property name in the results. Is this some kind of bug?

2

It’s technically behaving as designed, but it’s a limitation that bes properties "name" only returns one of them, and you may not predict which one it returns.

Instead you should use a whose() filter like

bes properties whose (name of it = "name" and name of source analysis of it = "analysis name")

You could also reference it by property ID, or name of site of source analysis, or any other property or analysis filters.

2 Likes
3

So even if the analysis does not run on the machine it is still reported for that machine but results are empty? Thats pretty akward design :slight_smile: .

Anyway thanks @JasonWalker for the hint - it seems that just changing bes properties "<name of the property>" into "bes properties whose (name of it = "<name of the property>") returns what we need. I still don’t understand why it works this way but as you pointed out if this is some internal design of how the analysis are handled then it may make sense.

4

So when using the bes property <string> session inspector, the documentation states:

Returns the first property whose name matches the given string. Note that it is not safe to assume that there is only one property with a given name.
Source: https://developer.bigfix.com/relevance/reference/string.html#bes-property-string-bes-property

Session relevance works deployment-wide so even if only a single endpoint is relevant for the analysis and only a single result is ever present, if you phrase the query to be across all endpoints then that is what the session relevance engine will do. As @JasonWalker pointed out, when there is the possibility in your deployment of multiple properties having the same name you should leverage the plural form bes properties and filter the results down to the singular result.

Here is a rework of your original query that will produce a result similar to how Web Reports or the Console would show. Note, I swapped name in for hostname since that property tends to be what most folks want but you can change it back if desired.

(name of item 1 of it | "<not reported>", (if (error flag of it) then ("<error>") else (concatenation ", " of values of it)) of result (item 0 of it, item 1 of it) | "<not reported>") of (bes properties whose (name of it = "Asset Owner" and name of source analysis of it = "Analysis Name"), bes computers whose (name of it as lowercase contains "test-computer"))
1 Like
5

Hello Mike, thanks for additional relevance query - I have most of it in my original query I was not putting all there because only thing that did not work was the fact that it does not return values for some machines.

It is true that documentation states that “returns the first property whose name matches” but it does not clarify it further so my understanding was if I have property with name “Asset Owner” and this property is set just ONCE for each machine it will actually return that property and will not make up some “empty” string because it see some analysis which is not relevant to the machine and which does not even populate the property for that machine. And again the logic where bes property "Asset Owner" returns empty but bes properties whose (name of it = "Asset Owner") returns valid result seems pretty odd me but if I understand it correctly then relevance engine compiles the relevance into some own representation and then hits first “Asset Owner” property it finds and tries to get this property from other machines in query without actually referring to property name but using just that internal representation. On the other hand when whose name of it is used it pulls out all properties for each single machine and actually gets only property name that matches its name.

6

Here is how I like to troubleshoot the property name duplication issue and then harden my code.

 (name of it, id of it, name of source analysis of it|"None") of bes properties whose (name of it as lowercase = "asset owner")

Then I can see which ID is the “right one” and in subsequent code I can use

bes property whose (id of it = (1,2,3))

where the ID is that (1,2,3) tuple.

you can also see any duplicate names with this query

(it, multiplicity of it) whose (item 1 of it > 1) of unique values of names of bes properties
3 Likes