Relevance Tip: Plural vs Singular

Tips
1

Relevance can be written to be Plural or Singular.

Relevance that is singular MUST have 1 and exactly 1 result to be valid.

Relevance that is plural can have 0 or more results.

Here is an example of a singular relevance statement:

(value "InstallDate" of key "HKLM\Software\Microsoft\Windows NT\CurrentVersion" of native registry) as string as integer * second + "01 Jan 1970 00:00:00" as local time

https://bigfix.me/relevance/details/2196

Here is an example of a plural relevance statement that returns the same information:

(it * second + "01 Jan 1970 00:00:00" as local time) of (it as string as trimmed string as integer) whose(0 != it) of values "InstallDate" of keys "HKLM\Software\Microsoft\Windows NT\CurrentVersion" of (x64 registries;x32 registries)

https://bigfix.me/relevance/details/3002576

In general, but most particularly for reporting, it is best to write relevance to be plural instead of singular. There are a few cases where you might need a singular result from plural relevance that should only have 1 result, and in those cases it is possible to convert a plural relevance statement into a singular one using the unique value inspector.

If I were to use the plural result above in a property, I would do the following:

unique values of (it * second + "01 Jan 1970 00:00:00" as local time) of (it as string as trimmed string as integer) whose(0 != it) of values "InstallDate" of keys "HKLM\Software\Microsoft\Windows NT\CurrentVersion" of (x64 registries;x32 registries)

This would collapse any duplication in the plural result. This is a good thing if you don’t need to know that there were duplicate results. This does not convert it into a singular result, it remains plural. Even if there is actually only 1 result, it is considered “plural”.

If I were to use the plural result above in a more complicated statement that required a singular result ( like a comparison ) then I could do the following:

unique value of (it * second + "01 Jan 1970 00:00:00" as local time) of (it as string as trimmed string as integer) whose(0 != it) of values "InstallDate" of keys "HKLM\Software\Microsoft\Windows NT\CurrentVersion" of (x64 registries;x32 registries)

This will convert it from a plural result, to a singular one. This will only work if there are not multiple different results.

5 Likes
2

Thanks James for the tip. I happen to have something about plural to share, too:

We can use plural to refer to non-existent object without causing error.

Q: not exists file "non-exist.txt" of folder "C:\non-exist"
E: Singular expression refers to nonexistent object.

Q: not exists file "non-exist.txt" of folders "C:\non-exist"
A: True
T: 0.367 ms

Note the folders plural in the 2nd Q.

Plurals can be written in the form of (A;B). We can use plurals to refer to multiple objects (of the same type).

Q: number of files of (windows folder)
A: 44
T: 7.885 ms

Q: number of files of (system folder)
A: 2308
T: 390.414 ms

Q: number of files of (folders "C:\non-exist"; windows folder; system folder)
A: 2352
T: 397.882 ms

— another example –

Q: number of keys whose (name of it = "A" OR name of it = "B") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes" of native registry
A: 0
T: 1.557 ms

Can be more efficiently written as:

Q: number of keys ("A";"B") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes" of native registry
A: 0
T: 0.133 ms
3 Likes
3

I would probably write it like this in most cases:

number of keys ("A";"B") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes" of (x64 registries; x32 registries)

I would write file as files:

not exists files "non-exist.txt" of folders "C:\non-exist"
4

Hi James,

Thanks for the reply!

For the 1st example, note the performance gain of using keys ("A";"B") over whose (name of it = "A" OR name of it = "B")

For the 2nd example, may I know why do you use “files” in this case?

5

For the first example, I wasn’t actually suggesting the part about using whose over using keys (“A”;“B”), I was actually referring to the rest of the relevance after that. I just copy and pasted the whose part.

For the 2nd example, I would recommend using the plural files instead because it prevents it from throwing an error. It makes more sense like this:

exists lines whose(it starts with "STRING") of files "a.txt" whose(exists lines of it) of folders "C:\temp"

files should be plural because the file may not exist. It ensures a true/false value rather than an error.

Again, this is my general recommendation, all relevance should be plural wherever possible.

6

Related Tip:

You can use exists to make a plural boolean value singular using this method: https://bigfix.me/relevance/details/3019156

exists master flags whose(TRUE = it) of current console users

Q: FALSEs whose(TRUE=it)
T: 0.021 ms
I: plural boolean

This doesn’t throw an error, or any result at all. The not throwing a non-existance error can be a good thing, but the complete lack of results can be a problem if further processing is needed.

Q: TRUEs whose(TRUE=it)
A: True
T: 0.026 ms
I: plural boolean

This returns a plural boolean result, which can’t be used in direct boolean comparisons.

Q: exists FALSEs whose(TRUE=it)
A: False
T: 0.029 ms
I: singular boolean

exists converts this non-result into a singular boolean result, which allows further processing of this result.

Q: exists TRUEs whose(TRUE=it)
A: True
T: 0.029 ms
I: singular boolean

This converts a plural TRUE into a singular TRUE for the cases where any true result should result in a true result. This will work with further direct boolean comparisons.