codingWithJimmy / TA-bigfix

Splunk technical add-on (TA) for ingesting BigFix client, relay, and server logs. Includes REST inputs for ingesting assets, relevant fixlets, action summaries, and analysis results.
GNU Affero General Public License v3.0
15 stars 1 forks source link

Infrastructure input fails when there're some hosts in bigfix that have never reported to the server #5

Closed arturenix closed 4 years ago

arturenix commented 4 years ago

Infrastructure input fails when there're some hosts in bigfix that have never reported to the server.

Workaround fix - add whose filter to request in bin/bigfix_infrastructure.cc.json:

--- bin/bigfix_infrastructure.cc.json  2019-12-13 11:32:00.000000000 -0500
+++ bin/bigfix_infrastructure.cc.json   2020-01-09 17:01:57.617838388 -0500
@@ -18,5 +18,5 @@
         {
             "request": {
-                "url": "{{__settings__.additional_parameters.bigfix_server_url}}:{{__settings__.additional_parameters.bigfix_server_port}}/api/query?output=json&relevance=%28%22nt_host%3D%22+%26+item+0+of+it%2C+%22last_report_time%3D%22+%26+item+1+of+it+as+string%2C+%22operating_system%3D%22+%26+item+2+of+it%2C+%22actionsite_size%3D%22+%26+item+3+of+it%2C+%22actionsite_version%3D%22+%26+item+4+of+it%2C+%22relay_free_space%3D%22+%26+item+5+of+it%2C+%22filldb_logfile_size%3D%22+%26+item+6+of+it%2C+%22bufferdir_file_count%3D%22+%26+item+7+of+it%2C+%22registration_list_size%3D%22+%26+item+8+of+it%29+of+%28name+of+it%2C+last+report+time+of+it%2C+operating+system+of+it%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AActionsite+Size%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AActionsite+Version%22%29+%2C+%28if+%28value+of+result+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ABES+Relay+Free+Disk+Space%22%29+%3D+%22N%2FA%22%29+then+%22%22+else+%28value+of+result+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ABES+Relay+Free+Disk+Space%22%29%29%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AFillDB+Log+File+Size%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ANumber+of+Files+in+FillDB+Bufferdir%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ARegistration+List+Size%22%29%29+of+bes+computers++",
+                "url": "{{__settings__.additional_parameters.bigfix_server_url}}:{{__settings__.additional_parameters.bigfix_server_port}}/api/query?output=json&relevance=%28%22nt_host%3D%22+%26+item+0+of+it%2C+%22last_report_time%3D%22+%26+item+1+of+it+as+string%2C+%22operating_system%3D%22+%26+item+2+of+it%2C+%22actionsite_size%3D%22+%26+item+3+of+it%2C+%22actionsite_version%3D%22+%26+item+4+of+it%2C+%22relay_free_space%3D%22+%26+item+5+of+it%2C+%22filldb_logfile_size%3D%22+%26+item+6+of+it%2C+%22bufferdir_file_count%3D%22+%26+item+7+of+it%2C+%22registration_list_size%3D%22+%26+item+8+of+it%29+of+%28name+of+it%2C+last+report+time+of+it%2C+operating+system+of+it%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AActionsite+Size%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AActionsite+Version%22%29+%2C+%28if+%28value+of+result+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ABES+Relay+Free+Disk+Space%22%29+%3D+%22N%2FA%22%29+then+%22%22+else+%28value+of+result+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ABES+Relay+Free+Disk+Space%22%29%29%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AFillDB+Log+File+Size%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ANumber+of+Files+in+FillDB+Bufferdir%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ARegistration+List+Size%22%29%29+of+bes+computers+whose+%28exists+operating+system+of+it%29++",
                 "method": "GET",
                 "headers": {},
@@ -86,3 +86,3 @@
         }
     ]
-}
\ No newline at end of file
+}
codingWithJimmy commented 4 years ago

I guess I'm not understanding the error. Is this for hosts that have "\<not reported>" as a value instead of a reported value?

arturenix commented 4 years ago

Correct. If such hosts exist, API call fails with error: {"result":[],"error":"Singular expression refers to nonexistent object."}

codingWithJimmy commented 4 years ago

Updated relevance query has been added to branch 2.0.0 of the add-on. Sorry for the delay.