I have a lookup file which only contains one single column with names of all Software updates, I need compliance for. I have a pivot query which provides details of each Software Update name along with its State if Install or applied. How do i write a query using combination of pivot query and my lookup file. so that my result is only for the list of names in my lookup instead of all software updates list available in index. ... View more

Hi , I have a query where I am trying to use Chart funtion to show for a particular application which have multiple versions of the same application installed show number of PC's that particular application got installed with InstallDate field under X-Axis and Y Axis shows the numbers I am able to acheive it .. But I do not want the field which is in my X-Axis to show fr all the dates, instead it should show in 3 days period like example: X-axis should say 1march, 4march, 7th march and y-axis should say overall sum of the installed count of pc's per application version |chart count(host) as #Hosts over InstallDate by DisplayVersion Here InstallDate is my x-axis fields.. ... View more

We have a uberAgent Dashboard for Bluescreen. We wanted to understand if there is a way to identify which driver caused the BSOD??? And how is BugCheck Code and Display Name picked from PCs?? ... View more

I have a compliance search which I have created using a lookup file that does gives results. However, for a product version which is higher than the one I have in the Lookup file should be considered as Compliant, but it is being considered as Non-Compliant in the result. I have a lookup file as csv format with below details DisplayName DisplayVersion Status Adobe Acrobat Reader DC 18.11.20040 Compliant I am using a query like below where one of the Application Name is not actually the name of the Application, but it is a Plugin to the main application so I am excluding not be searched for (Extended Asian Language font pack for Adobe Acrobat Reader DC). index=abc_aa sourcetype=xxxxxxxx OsVersion=10.0 host="*" (DisplayName="Adobe Acrobat Reader DC" AND DisplayName!="Extended Asian Language font pack for Adobe Acrobat Reader DC") | table host DisplayName DisplayVersion OsVersion | lookup Coreapps.csv DisplayVersion OUTPUTNEW Status | eval Status=if((isnull(Status),"NonCompliant",Status) I am able to get result with table command ... but in the results: If I have a PC in which the Application version is greater than the one I have in my lookup file (18.11.20040 is in my lookup file), it takes that version as Non-Complaint which actually should not be the case as it is higher version.. I do not want to add that higher version in the lookup file. Is there any other option to detect any version higher than or equal to the one I have selected is Compliant and lower then it is Non-Compliant? How do I achieve it?? ... View more

I am create a dashboard panel with dropdown and when I select a particular dropdown, the output says No results found. Need to understans how to correct them Adobe Reader Adobe Flash MS Silverlight Java All All When I only select Java, I see the Output, but when I selevt others like Adobe or MS, it says No results found. ... View more