3 Replies Latest reply on Dec 6, 2018 11:28 AM by Andrew Waters

    Query help with SI that has both SI in one computer

    John So
    John So Dec 5, 2018 4:06 PM
      Share:|

      Hello, Communities!

       

      We would like to look for two SI in the machine.  We used the and condition but, does return the items need but, when we do OR condition the query return two many items.  The goal of the query is to bring back servers with both software instances on the server.

       

      Here is the query being used.

       

      search SoftwareInstance 
where name has subword 'eg Monitors' or name has subword 'egagent' 
show type, name, product_version, #RunningSoftware:HostedSoftware:Host:.name as 'Host'

       

      What are we doing wrong?

       

      Are there good tutorials on the query language?  We've taken the discovery class but, it didn't review the query language in detail.  Would love to learn more.

       

      Regards,

      John So

        • 1. Re: Query help with SI that has both SI in one computer
          Andrew Waters
          Andrew Waters Employee Dec 6, 2018 1:17 AM (in response to John So)

          What do you mean it returns too many items?

           

          Have you read the documentation on the behaviour of subword when you have more than one word in the value you are matching.

          • 2. Re: Query help with SI that has both SI in one computer
            John So
            John So Dec 6, 2018 10:54 AM (in response to Andrew Waters)

            The query returns two SI for the same host.  We would want to group the host instead of showing duplicate host the two SI.  Here is a screenshot of the results now.

             

            Screen Shot 2018-12-06 at 8.45.56 AM.png

            And the query gives hosts with just one of the SI, not both.  That's what we mean by too many.  We would want to group them and show only servers with both SIs.

             

            Regards,

            John So

            • 3. Re: Query help with SI that has both SI in one computer
              Andrew Waters
              Andrew Waters Employee Dec 6, 2018 11:28 AM (in response to John So)

              This is what you have asked it to do. If you want to end up with a single Host you need to be on the Host when you showing the result. In recent versions (11.2 and later) you could do, which filters down the Hosts

              SEARCH SoftwareInstance

              WHERE name HAS SUBWORD "eg Monitors"

                OR name HAS SUBWORD "epagent"

              TRAVERSE RunningSoftware:HostedSoftware:Host:Host

              WITH (TRAVERSE Host:HostedSoftware:RunningSoftware:SoftwareInstance as si

                        WHERE name HAS SUBWORD "eg Monitors" OR name HAS SUBWORD "epagent")

              SHOW name, #si.type, #si.name

              If most Hosts have the SIs then you could do

              SEARCH Host

              WITH (TRAVERSE Host:HostedSoftware:RunningSoftware:SoftwareInstance as si

                        WHERE name HAS SUBWORD "eg Monitors" OR name HAS SUBWORD "epagent")

              WHERE #si

              SHOW name, #si.type, #si.name

              3 of 3 people found this helpful