Session Relevance, Analyses results and the Rest API (BigFix)

Session Relevance, Analyses results and the Rest API

DanielHeth Comment (1) Visits (10807)

Recently I needed to pull specific analysis results from my deployment via the REST API. The only way to do this is using the /api/query (http://bigfix.me/restapi/?id=306).

This meant that I needed to figure out a session relevance statement to do this and quickly. Since I’m not a native “session relevance speaker”, I looked at my options. One was to research, research, and more research using very valuable public resources like the Inspectors Guide (http://support.bigfix.com/inspectors/Fixlet%20Objects_Any.html), but research often does not equal fast. My other option was to reach out to colleagues with that native session relevance ability. This lead me to my manager, John. I consider him a great resource to help figure out those unusual session relevance problems. The following is an excerpt from a recent chat I had with him regarding pulling results from analyses. I hope this helps you guys as much as it helped me.

Me	Do you have a quick/simple example on using session relevance to pull results of an analysis?
John	session.. sure.. do you need to start at the Analysis or the AnalysisProperty?
Me	analysis/property
John	ok - so we can either start with a BES Fixlet (if you want to start with the analysis object) or with a BES Property - if you don't care that much about the analysis. guess I can show you both...
Me	Thanks... both would be handy. Once you tell me I file this stuff away and publish if need be so i don't have to ask a 3rd time.
John



Me	I think this works perfectly... and then i can call the "values of properties whose (name of it = "xx") of...."
John
	and you can drill around like this:
	(name of computer of it, values of it) of results of properties of BES Fixlets whose (analysis flag of it and name of it = "Test Analysis 1")
	or
	let me pick an analysis with some actual property results... sec.
Me	sure
John	names of BES Fixlets whose (analysis flag of it and exists activation whose (active flag of it) of it)

	names of properties of BES Fixlets whose (analysis flag of it and exists activation whose (active flag of it) of it and name of it = "Application Usage Information")


	ok - so that is starting from a BES Fixlet (analysis) you can also skip directly to the BES Property object, if you know it.

	bes properties whose (name of it = "All Application Usage Information")
	(names of computers of it, values of it) of results of bes properties whose (name of it = "All Application Usage Information")
	or you could identify the property by it's ID... (safer since duplicate property names can really ruin your day)


Me	I think this gets me exactly what i was looking for... thanks! i may copy/paste this right into a blog article and add some additional comments. LOL. good stuff for the endpoint manager blog i think.
John	oh - of note - that tuple for BES Property ID is (SiteID, FixletID,PropertyID) for external sites, that would be the same for all customers.
Me	for that particular property... I'd assume it'd be different for custom content right? (PropertyID across multiple deployments)
John	yes.

	that first number is actually the ID of the actionsite for this customer.
	the built in properties are installed into the actionsite on server install and are technically not "external content"
	but an analysis in BES License and Inventory will have the same ID for all customers.
Me	ah... good point. now that you mention it i can see that clearly.
John	note that on large deployments, pulling massive results sets can be expensive, so use care?
	technique I like to use there – use values of results (bes property whose (id of it = 8032,3,1),bes computer whose (id of it mod 10,000=0))
	that will only show the results on 1/10000 endpoints roughly
	you can reduce the mod number as you gain confidence in your query
	you can do the same with computer groups:
	values of results (bes property whose (id of it = 8032,3,1),members of bes computer group whose ( name of it = "Test Computers") )
	that method documented here:

Me	I like the mod technique.. very handy for those large deployments. The target for my immediate query has low client counts... but i will be sure this gets into the article
John	used it extensively on one deployment when querying vs 250k endpoints and trying to see how many results we could bring back in a single pull
	we could do 40 results across about 200k endpoints in about 15 minutes
	but the mod allowed us to slowly ratchet up the total result set without crashing the web reports server.
Me	Thanks!!!!!
John	ask something new next month