-
1. Re: Query help with SI that has both SI in one computer
Andrew WatersDec 6, 2018 1:17 AM (in response to John So)
What do you mean it returns too many items?
Have you read the documentation on the behaviour of subword when you have more than one word in the value you are matching.
-
2. Re: Query help with SI that has both SI in one computer
John So Dec 6, 2018 10:54 AM (in response to Andrew Waters)The query returns two SI for the same host. We would want to group the host instead of showing duplicate host the two SI. Here is a screenshot of the results now.
And the query gives hosts with just one of the SI, not both. That's what we mean by too many. We would want to group them and show only servers with both SIs.
Regards,
John So
-
3. Re: Query help with SI that has both SI in one computer
Andrew WatersDec 6, 2018 11:28 AM (in response to John So)
3 of 3 people found this helpfulThis is what you have asked it to do. If you want to end up with a single Host you need to be on the Host when you showing the result. In recent versions (11.2 and later) you could do, which filters down the Hosts
SEARCH SoftwareInstance
WHERE name HAS SUBWORD "eg Monitors"
OR name HAS SUBWORD "epagent"
TRAVERSE RunningSoftware:HostedSoftware:Host:Host
WITH (TRAVERSE Host:HostedSoftware:RunningSoftware:SoftwareInstance as si
WHERE name HAS SUBWORD "eg Monitors" OR name HAS SUBWORD "epagent")
SHOW name, #si.type, #si.name
If most Hosts have the SIs then you could do
SEARCH Host
WITH (TRAVERSE Host:HostedSoftware:RunningSoftware:SoftwareInstance as si
WHERE name HAS SUBWORD "eg Monitors" OR name HAS SUBWORD "epagent")
WHERE #si
SHOW name, #si.type, #si.name