WMI analysis with multiple outputs

[JesperG]

Greetings,

I have a issue with an analysis.

This is my analysis:

if (exists wmi) then (string value of property "caption" of it, (string value of property "size" of it)) of (select objects "Caption, size from Win32_DiskDrive" of wmi) else nothings

This is the output:

ST2000DM001-1CH164, 2000396321280
Samsung SSD 840 EVO 120GB, 120031511040

The problem is when I want to put more data in the analysis from different WMI’s I get duplicate results:

if (exists WMI) then (string values of selects "Caption from Win32_DiskDrive" of WMI), (string values of selects "Size from Win32_DiskDrive" of WMI), (string values of selects "Caption from Win32_DiskPartition" of WMI) else nothings

Results:

ST2000DM001-1CH164, 2000396321280, ( Disk #1, Partition #0 )
ST2000DM001-1CH164, 2000396321280, ( Disk #0, Partition #0 )
ST2000DM001-1CH164, 2000396321280, ( Disk #0, Partition #1 )
ST2000DM001-1CH164, 120031511040, ( Disk #1, Partition #0 )
ST2000DM001-1CH164, 120031511040, ( Disk #0, Partition #0 )
ST2000DM001-1CH164, 120031511040, ( Disk #0, Partition #1 )
Samsung SSD 840 EVO 120GB, 2000396321280, ( Disk #1, Partition #0 )
Samsung SSD 840 EVO 120GB, 2000396321280, ( Disk #0, Partition #0 )
Samsung SSD 840 EVO 120GB, 2000396321280, ( Disk #0, Partition #1 )
Samsung SSD 840 EVO 120GB, 120031511040, ( Disk #1, Partition #0 )
Samsung SSD 840 EVO 120GB, 120031511040, ( Disk #0, Partition #0 )
Samsung SSD 840 EVO 120GB, 120031511040, ( Disk #0, Partition #1 )

This is where I get too many results.

I have been looking at concatenation, but it requires singular result.

I am unsure how to proceed from here.

Thanks,
Jesper

[Sean]

Hi Jesper,

Unfortunately this ends up being fairly complicated using relevance. But this related post should help:

WMI "Associators"

(imported topic written by NickFries91) Hi, Do you guys support the ASSOCIATORS statement? http://msdn.microsoft.com/en-us/library/aa384793(VS.85).aspx Here’s some output when I try to use ASSOCIATORS- Q:string value of select “ASSOCIATORS OF {Win32_DiskPartition.DeviceID=‘Disk #0, Partition #1’} WHERE ResultClass=Win32_DiskDrive” of wmi E: The expression could not be evaluated: Windows Error: unknown error 0x80041017 I suspect it is appending a “SELECT” when it sends it off to WMI… Thoug…

[jgstew]

@JesperG

concatenation, but it requires singular result

Not exactly. Concatenation can be used on each set of results. Also it requires all output to be strings, but most can be converted to strings before using concatenation.

@JesperG

put more data in the analysis from different WMI’s

The issue is how you are combining them. You need a much more complicated statement to combine them without duplication.

Related:

• https://bigfix.me/analysis/details/2994706
• https://bigfix.me/relevance/details/3006004

[JesperG]

Greetings guys,

I thank you for your input.

It seems I was trying too hard to gain something that was not so easily obtainable.
I have chosen to go another way by outputting it in two properties and working with it in Excel afterwards.

Thank you again.

[jgstew]

What is an example of the final output you were looking for?