Relevance search for computer with thousands of possibilities

I need to return a list of computers from a list of sites. I’m doing all of this via the api. I’ve built some logic that works for small sets of sites, but when it gets to hundreds or thousands, it times out. Here’s what I have that works for small numbers of sites.

(ID of it, 
names of it , 
value of results from (bes property "Site") of it as string | "not reported", 
value of results from (bes property "Relay") of it as string | "not reported" 
) 
of bes computers 
whose (
(
 (value of results (bes property "Site" , it) as uppercase = "s02" as uppercase)
	 or  (value of results (bes property "Site" , it) as uppercase = "s12" as uppercase)
	 or  (value of results (bes property "Site" , it) as uppercase = "s16" as uppercase)
	 or  (value of results (bes property "Site" , it) as uppercase = "s20" as uppercase)
) 
and (name of it as lowercase contains "bla"))

So for the query build it would just keep adding ORs for each site name. I’m thinking if I switch to a tuples, it could speed things up, but I can’t quite get the syntax right.

(ID of it, 
names of it , 
value of results from (bes property "Site")  of it as string | "not reported", 
value of results from (bes property "Relay") of it as string | "not reported" 
) 
of bes computers 
whose (
(
 exists ("s02";"s12";"s16";"s20") 
 whose (value of (bes property "Site") as string as uppercase contains it)
) 
and (name of it as lowercase contains "bla"))

Am I on the right track, or should I attack this differently?

I would probably use a set for this:

(set of ("s02"; "s12")) contains (value of result from (bes property "Relay") of it as string)

In addition there is a session object called, relay server of <bes computer> which may speed up the data retrieval:

(relay server of it) | "not reported" 

It will also probably be faster to move the name filter infront of the “site” filter as that is probably a much faster query:

and (name of it as lowercase contains "bla")

So (I haven’t run this):

(
  ID of it, 
  names of it , 
  value of results from (bes property "Site")  of it as string | "not reported", 
  relay server of it | "not reported"
) 
of bes computers 
whose (
  (name of it as lowercase contains "bla")
 and
  (set of ("S02"; "S12"; "S16"; "S20")) contains (value of result from (bes property "Site") of it as string as uppercase)
)
1 Like

Only thing that didn’t work right was the “relay server of it” part. That one puked. Over all though, that did the trick. Only problem is now dealing with some limitations of how to run the query. The query gets too big to use “…/api/query?relevance=…” as a GET. I have to use the POST method.

Thanks again!

1 Like

follow-follow up. With all of the “Sites” populated in one of the larger queries, it still takes about 4 minutes to run. :scream:

Still is better than timing out all together!

I’m confused about what you are trying to do and why. If I knew more about the final result and the need, I may be able to suggest a better way to go about this.

Do you need to get this result from all computers, or just specific computers?

It might be better to start with an automatic group that filters to just the computers you need to get these results from, then query the computers of that automatic group.

Part of your issue is that bes computers is going to examine EVERY computer even when not required.

What is bes property "Site" and does it relate to Custom Sites within BigFix, or this is physical locations/offices?

Good point James. Perhaps I can filter it down to a group, then on “site”. The site property is the assigned site number. Just something we set on all endpoints based on IP range (sort of more than that, but you get the point).

Would add more complexity, since the target group of machines changes, but I think I could work that in too.

All that said, this code has been in production for a while. I could revisit.

1 Like

I am a bit late to the party. I haven’t been keeping up with the forum since ~April.

The automatic group could be a larger set of machines, but smaller than ALL machines. It wouldn’t have to be perfect, just limiting the maximum number of machines that need to be examined.

Thought the forums were quiet. :grinning:

1 Like