oops, formatting problems in previous answer:

This query shows Hosts that have not been scanned in the past 30 days: 

Search Host where last_update_success < (currentTime() - 30*24*3600*10000000) 
show name, os, last_update_success, age_count 

Change the 30 to the number of days you want.

Lisa

No that is not what the query does. What is does is show the Hosts that have not be successfully scanned in the last 30 days.

Why do you care about skipped if you want a list of servers not scanned in the last 7 weeks?

Hi Andrew,

Is it possible to use the last_update_success attribute with the discovery access? I am trying to pull a  report where Discovery Access result was success anytime in last 3 days, not necessarily the last access.

Regards,

Manu

But last_update_success is the last success. You should be able to just use that.

thanks Andrew. How do I restrict my search where Discovery access is Success in the last three days?

Regards,

Manu

This is almost exactly the same as the query earlier in this thread. Just reverse the direction of the test, i.e. < becomes >

Hi Andrew,

search DiscoveryAccess where  last_update_success > (currentTime() - 3*24*3600*10000000) - This doesn't fetch any results for me although there are more than 5000 plus discovery access with result as Success from yesterday's scan. Any pointers where I am going wrong?

Regards,

Manu

I assumed you meant Hosts not DiscoveryAccesses.

Then just search DiscoveryAcccess

SEARCH DiscoveryAccess

WHERE end_state = 'GoodAccess'

  AND starttime > (currentTime() - 3*24*3600*10000000)

Similar query is:

SEARCH DiscoveryAccess

WHERE result = 'Success'

  AND starttime > (currentTime() - 3*24*3600*10000000)

It really depends upon what you are after.

The problem / advantage of checking result is that ECAErrors from patterns will not be found. GoodAccess means it basically found enough to be scanning the device.

Thanks Andrew and Brice.

Regards,

Manu

Hi Andrew/Brice,

While I use this query it is giving me all the success results for a endpoint in last 3 days.so if a host is all success in last 3 days it gives me 3 entries against that host.Is there a way to get just one entry against each endpoint, just the latest success ? I tried using countUnique but I have multiple columns in my query.

regards,
Manu