Session relevance question pulling back baselines

I’m trying to write a very specific session relevance to pull back action data and I just can’t seem to get there 100%. Here is what I have so far.

(id of it, (statuses of results of it) whose (it as string contains ""), names of computers of results of it, name of it, name of parent groups of it) of (member actions of it) of unique values of (bes actions whose ((date (local time zone) of it) of now - 60 * day < end date of it))

What I’m trying to do is pull back all of the actions of baselines that have been submitted and retrieve their subaction status. Here is my use case. We only patch via baselines and each baseline has as its first action a fixlet with a version number as its name (ex. Sept 2015, Oct 2015, etc.) and I want to pull back all of the action info for just that months patches. We have multiple baselines per month so it needs to grab all of them. As it stands, the above session relevance pulls back all of the info I need but I’m just grabbing the last 60 days worth. I want specific actions, and that’s where I’m in trouble. What I want is something like the following.

(id of it, (statuses of results of it) whose (it as string contains ""), names of computers of results of it, name of it, name of parent groups of it) of (member actions of it) of unique values of (bes actions whose (name of member action of it contains "Sept 2015")) - but that doesn’t work, it pulls back something entirely different.

Any ideas?

1 Like

Here is an idea - a Session Relevance statement with a construct that might help you filter what you need.

In the last 3 lines, you get to filter based on the Baseline, the Action taken against the Baseline, and all the member Fixlets.

(
    name of parent group of action of it,
    name of action of it,
    name of computer of it,
    status of it
) of results of 
    member actions whose (name of it = "Some Fixlet or conditions of interest") of 
    taken actions whose (current date - end date of it < 60 * day) of 
    bes baselines whose (name of it contains "Sept 2015")
1 Like

Thanks for your response, while your posted relevance was not what I was looking for it did send me down the right path. The code that I had which I modified from your post was

(id of it, (statuses of results of it) whose (it as string contains “”), names of computers of results of it, name of it, name of parent groups of it) of (member actions of it) of unique values of taken actions of bes baselines whose (exists names whose (it contains “my version”) of components of component groups of it)

I realized the code you posted was just looking at the action history of existing baselines on my server. I was looking for action history of all action history on the server. Our baselines are deleted each month and I wanted a single relevance that would work for current as well as historical data. So off I went modifying the code again. That’s when I finally got it…

(id of it, (statuses of results of it) whose (it as string = regex “Failed|Pending Downloads”), names of computers of results of it, name of it, name of parent groups of it, id of parent groups of it) of (member actions of it) of bes actions whose (exists member actions whose (exists names whose (it contains “my version”) of it) of it)

Of course this is just for the Failed, changing it to (it as string contains “”) instead will pull back all results. Our main use case is just looking for failure or missing sha files.

Thanks for your help on this.

1 Like