The problem with the c:\windows\system32\dns folder is that, as a 32-bit application, BigFix’s Relevance is normally redirected to c:\windows\syswow64\dns. You can work around that using something like
lines of file "DnsSettings.txt" of folder "dns" of native system folder
or
’lines of file “DnsSettings.txt” of native folder “c:\windows\system32\dns”`
The “section of file” inspector is intended to deal with INI-formatted files, and is lacking in several areas (such as no iterator for “sections” or “keys”). It doesn’t return a String or a Line, it returns a Section; and a Section only has one property = “key of : string”
So, for an INI file, you can do something like
q: lines of file "c:\temp\test.ini"
A: [section1]
A: var1=value1
A: this is a normal line
A: [section2]
A: var2=value2
A: var2.1=value2.1
T: 0.599 ms
q: key "var1" of section "section1" of file "c:\temp\test.ini"
A: value1
T: 0.384 ms
There are probably many ways to do what you want. My first approach is to get the line numbers of the lines you’re looking for, and retrieve the lines in between them:
q: (line numbers of lines whose (it="[section1]") of it, line numbers of lines whose (it="[section2]") of it) of file "c:\temp\test.ini"
A: 1, 4, "test.ini" "" "" "" ""
T: 1.498 ms
Then I can get the line numbers of all the lines in between, and retrieve those lines:
q: lines (((integers in (item 0 of it + 1, item 1 of it - 1)) of (line numbers of lines whose (it="[section1]") of it, line numbers of lines whose (it="[section2]") of it, it)) of it) of file "c:\temp\test.ini"
A: var1=value1
A: this is a normal line
T: 1.185 ms
So I think you could try
q: lines (((integers in (item 0 of it + 1, item 1 of it - 1)) of (line numbers of lines whose (it="[Zones]") of it, line numbers of lines whose (it="[Cache]") of it, it)) of it) of file "DnsSettings.txt" of folder "dns" of native system folder
An older approach that I used to use for things like this, before I knew better, was to concat the lines together into one giant string, grab the text between delimites, and then split the results, like
q: substrings separated by "%0d%0a" of preceding text of first "[section2]" of following text of first "[section1]%0d%0a" of concatenation "%0d%0a" of lines of file "c:\temp\test.ini"
A: var1=value1
A: this is a normal line
A:
T: 0.762 ms
… which, now that I look at it again, actually seems to evaluate more efficiently, at least for small files.