6 Replies Latest reply on May 7, 2020 11:44 AM by Vishnu Parihar


    Vishnu Parihar
      Share This:

      Hello Discovery Experts,


      We are scanning a CI thrice a week and I've observed that because of some network issues or may some other issues we're getting different-different results for a CI.

      i.e CI abc.bmc.com - is scanned three times a week: Tuesday, Thursday and Saturday:


      Below are the results:

           Tuesday - GoodAccess

           Thursday - NoAccess or Error or NoResponse or Skipped

           Saturday - NoAccess or Error or NoResponse or Skipped

           Tuesday - NoAccess or Error or NoResponse or Skipped (This is next week scan)


      Now we need a report(That I am getting with below query):


      search Host traverse InferredElement:::DiscoveryAccess where starttime defined and starttime > currentTime() - 7 * 24 * 3600 * 10000000 order by (discovery_endtime or endtime) desc show endpoint, #DiscoveryAccess:DiscoveryAccessResult:DiscoveryResult:DeviceInfo.hostname as 'Hostname', result, end_state, reason, device_summary, discovery_starttime, discovery_endtime


      Now it's time to to filter it out, if the CI got GoodAccess in between i.e as per above result on Saturday CI got successfully scanned, in this case we don't need that CI in the report at all.

      In short, if the CI getting failed continuous 3 times, we need that CI in report and if CI is getting successfully scanned once out of three scan we don't need that CI in report.


      I also go through with below link that helps me but not much.


      Re: DAs with No Access & No Response Report



      Vishnu Parihar

        • 1. Re: Reporting
          Andrew Waters

          Is there a reason you cannot look at last_update_success on the Host? (docs)

          • 2. Re: Reporting
            Vishnu Parihar

            Yes, as per above example we're going to take weekly report and in week we're scanning thrice. Now if we'll consider the last_update_success then it going to give the report according to the last scan only.


            That's why I was wondering if it it possible to store all three scan results in an array and let's compare that array with string 'GoodAcess'.

            • 3. Re: Reporting
              Vishnu Parihar

              Andrew Waters any suggestions here please?

              • 4. Re: Reporting
                Andrew Waters

                No - that is not was last_update_success means. If it did not work it was not a success and hence that will not be update (last_update_failure will be updated).


                Why do you need to do that? Why not just check is last_update_success was in the last week? If it was don't include it.

                2 of 2 people found this helpful
                • 5. Re: Reporting
                  Bob Anderson



                  As Andrew suggested, use the last_update_success for your filter on the Hosts.


                  Since you are only interested in Hosts that did not have a successful scan in the last 7 days, here is a query to show those hosts where the last_success is older than 7 days.  It will show the name, when was the last_success and if there is a failure, when was the last failure, the chosen-endpoint for the host.


                  search Host where last_update_success < currentTime() - 7 * 24 * 3600 * 10000000



                  whenWasThat(last_update_success) as 'When Success',

                  (last_update_failure and whenWasThat(last_update_failure) or 'No Failures') as 'When Failed',

                  #:ChosenEndpoint::.endpoint as 'Discovery Endpoint'


                  What more do you want to see for those hosts that were not successful in the last 7 days?


                  If you need DiscoveryAccess information for these nodes, then use key_expressions or traverse to the DA's.

                  2 of 2 people found this helpful
                  • 6. Re: Reporting
                    Vishnu Parihar

                    Thank you Bob !