While I think this is a basic function of relevance, and I’ve been reading countless support articles around using the “preceding texts” command to pull just the first part of the FQDN of the domain from the registry. Still after all that, the code fails to work. As I didn’t see a post for this SPECIFIC use-case I figured I’d post it for assistance.
So when I get the domain name from this relevance:
value “Domain” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters” of registry as string
It comes back:
A:PROD.ACME.THISCO.DOM
So, simple enough I write my code around that query:
Q:(preceding texts of first “.” of value “Domain” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters” of registry as string)
E: The operator “first” is not defined.
If we pop this into Fixlet Debugger and press View > Show Type Information we can better see what is going on.
If we run:
Q: value "Domain" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters" of registry
A: ad.mydomain.tld
T: 0.146 ms
I: singular registry key value
So we can’t take preceding text of first "." of <registry key value> because that property doesn’t exist.
Now I can already hear you saying that it’s cast as a string (as string) so that shouldn’t matter
Unfortunately casts are lower in the order of operations than properties are so what the original relevance essentially says is this (notice how we are still receiving the same error):
Q:(preceding texts of first "." of value "Domain" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters" of registry) as string
E: The operator "first" is not defined.
So the solution here is that we need to cast our Registry Key Value to a string before we do string manipulations like preceding text of first:
Q:preceding texts of first "." of (value "Domain" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters" of registry as string)
A: ad
T: 0.193 ms
I: plural substring
unique values of preceding texts of firsts "." (it as string) of values "Domain" of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters" of (x64 registries;x32 registries)
I prefer to use all plurals and keep the right to left flow of the relevance. (x64 registries;x32 registries) isn’t needed in this case since we are not examining the SOFTWARE key, but I tend to just use it everywhere and collapse any duplication using unique values. By using x64 registries as a plural, it will also work on 32bit systems and just skip that.
Without the redundant (in this specific case) x64 registries, then it would look like this:
unique values of preceding texts of firsts "." (it as string) of values "Domain" of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters" of registries
Technically for this specific example unique values of … is also redundant, but I tend to use it everywhere and it won’t cause any harm in the case of a single result since it will be processed very quickly.