2 Replies Latest reply on Aug 28, 2019 4:57 AM by Jonathan Karstrom

    Filter result in list after Explode in Discovery Query language

    Jonathan Karstrom
      Share This:

      Hi,

       

      I'm trying to create a query that searches for a specific discovered service related to a host and it's state (running/stopped). The problem I have ran into is that I can't filter out the specific service that i'm looking for after the explode statement in the query. Is there a way to filter the result after you have exploded a list?

       

      See the query below:

       

      SEARCH Host WITH #InferredElement:Inference:Associate:DiscoveryAccess.#DiscoveryAccess:DiscoveryAccessResult:DiscoveryResult:ServiceList.#List:List:Member:DiscoveredService AS service WHERE service.name HAS SUBWORD 'ccmexec' SHOW name, os, EXPLODE service.name AS 'Name', service.state AS 'State' PROCESSWITH WHERE service.name HAS SUBWORD 'ccmexec'

       

      If I try to run this query I'll get the Error Error In Results: No keys set and if I remove the PROCESSWITH statement I'll get all services discovered on a Host where the specific service is found but not just the specific service I'm looking for.

       

      I also have tried this query but then it seems as the PROCESSWITH statement doesn't work as I still get all services on the host that has the specific service I'm looking for but it doesn't filter out the other service that does not match the name I'm looking for.

       

      SEARCH Host WHERE #InferredElement:Inference:Associate:DiscoveryAccess.#DiscoveryAccess:DiscoveryAccessResult:DiscoveryResult:ServiceList.#List:List:Member:DiscoveredService.name  HAS SUBWORD 'ccmexec' SHOW name, os, EXPLODE #InferredElement:Inference:Associate:DiscoveryAccess.#DiscoveryAccess:DiscoveryAccessResult:DiscoveryResult:ServiceList.#List:List:Member:DiscoveredService.name AS 'Name', #InferredElement:Inference:Associate:DiscoveryAccess.#DiscoveryAccess:DiscoveryAccessResult:DiscoveryResult:ServiceList.#List:List:Member:DiscoveredService.state AS 'State' PROCESSWITH WHERE * HAS SUBWORD 'ccmexec'

       

      Anyone have any suggestions how to fix this issue?

       

      Regards,

      Jonathan Karström

      Swedish Social Insurance Agency