/build/static/layout/Breadcrumb_cap_w.png

Report that shows uninstalls but not updates?

I wrote the following SQL script to show me the un-installs in my system:

SELECT MACHINE.USER_FULLNAME, MACHINE.User, ASSET_HISTORY.NAME, ASSET_HISTORY.TIME, ASSET_HISTORY.VALUE1 as Software, ASSET_HISTORY.VALUE2 as Version, ASSET_HISTORY.CHANGE_TYPE
FROM MACHINE JOIN ASSET_HISTORY ON MACHINE.Name =ASSET_HISTORY.NAME
WHERE FIELD_NAME = 'SOFTWARE'
AND CHANGE_TYPE = 'No longer detected'
AND TIME > DATE_SUB(CURDATE(), INTERVAL 7 DAY)
ORDER BY ASSET_HISTORY.VALUE1 ASC;

but the problem with that is that most of the software that appears there is software that was updated, even minor updates. Any idea how to modify it so it doesen't show updates?


0 Comments   [ + ] Show comments

Answers (1)

Posted by: SMal.tmcc 5 years ago
Red Belt
0

create a CIR and report on that

ShellCommandTextReturn(powershell Get-eventlog -logname application -InstanceID 1034|select Timegenerated,message)

or

ShellCommandTextReturn(powershell Get-eventlog -logname application -InstanceID 1034|select Timegenerated,message|format-list)


Comments:
  • How can I report on CIRs ? Which table are they under? I don't see them in the MACHINE table.... - marcoeangeli 5 years ago
    • you can use the wizard to create the report and select the CIR on at the bottom of page 2

      if you want to do it in SQL here is a example for from my sma that reads a cir into a report

      SELECT MACHINE.NAME AS SYSTEM_NAME, (SELECT REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(MACHINE_CUSTOM_INVENTORY.STR_FIELD_VALUE, '&gt;', '>'), '&lt;', '<'), '&amp;', '&'), '&#039;', '\''), '&quot;', '"') FROM MACHINE_CUSTOM_INVENTORY WHERE MACHINE_CUSTOM_INVENTORY.ID=MACHINE.ID AND MACHINE_CUSTOM_INVENTORY.SOFTWARE_ID=28837) AS MACHINE_CUSTOM_INVENTORY_0_28837 FROM MACHINE ORDER BY SYSTEM_NAME - SMal.tmcc 5 years ago
    • Note: CIR's run with the inventory cycle, so if you create one it will not populate until inventory runs.

      You can also do a Null filter to see which devices did not get the command to run the CIR yet.

      I usually filter "if the CIR is null" to not get those machines the inventory has not yet run on. If you use "CIR is null" you will see which ones that it has not run on yet. - SMal.tmcc 5 years ago

Don't be a Stranger!

Sign up today to participate, stay informed, earn points and establish a reputation for yourself!

Sign up! or login

Share

 
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ