Plural to Singular? Formatting options? Unique? Help?

Content Authoring
1

I’m putting together a relevance statement to collect Windows application information from the Uninstall keys in the registry. The information is there, but I need in a particular format.

The relevance:

(values "DisplayName" of it as string, values "Publisher" of it as string, values "DisplayVersion" of it as string) of keys of keys "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)

yields:

A: AutoHotkey 1.1.32.00, Lexikos, 1.1.32.00
A: Cisco AnyConnect Secure Mobility Client , ( Cisco Systems, Inc. ), 4.6.03049
A: Google Chrome, Google LLC, 79.0.3945.117

which I need to look like this:

AutoHotkey 1.1.32.00 (Lexikos)|1.1.32.00
Cisco AnyConnect Secure Mobility Client (Cisco Systems, Inc.)|4.6.03049
Google Chrome (Google LLC)|79.0.3945.117

(or “DisplayName + space + open paren + Publisher + close paren + pipe + Version”)

The problems I’m running into are several:

  • How can I work unique into this? Should I?
  • How can I “flatten” the plural values (like the “( Cisco Systems, Inc. )”) into singular values?
  • How can I format the values as needed? (The format relevance command appears to require singular values, so the preceeding question may resolve this one)

I’m using plurals as a best practice (a la @jgstew) in order to avoid errors, but may be able to not do that as these registry keys are fairly (if not completely) consistent.

Anyone have an idea that’ll help me get what I need? Thanks!

2

You would use a parentheses block to deal with each result individually. In fact that’s what you’re doing with (value "X" of it) of keys of key "Y" of registry - you have multiple keys returned, and use the () block to deal with the values of one of those key results. You just need to take it one step further to deal with the multiple values results -

(item 0 of it & "|" & item 1 of it & "|" & item 2 of it) of(values "DisplayName" of it as string, values "Publisher" of it as string, values "DisplayVersion" of it as string) of keys of keys "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)

2 Likes
3

Thanks, @JasonWalker! I’ve used item N before, but it was a while ago, my memory isn’t what it used to be, and the search terms for my problems always seem to be super-generic. :slight_smile:

4

Now to try to capture similar information for macOS. Sigh…

5

NOTE: because these are plural in this way, then the results will only contain those in which all 3 are present. If any of these values is missing, then BigFix will remove it from the results entirely.

To handle this case, but include ALL results, then you would need to do the following:

(value "DisplayName" of it as string | "NoDisplayName" , value "Publisher" of it as string | "NoPublisher" , value "DisplayVersion" of it as string | "NoDisplayVersion" )
2 Likes