cancel
Showing results for 
Search instead for 
Did you mean: 

Cannot find query in ePO report

Jump to solution
I have a report that runs each week which is a table from a query. I am unable to find the query to modify it. It was created by another administrator. Can you help me locate the query? Tom
1 Solution

Accepted Solutions
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 8 of 10

Re: Cannot find query in ePO report

Jump to solution

what I would suggest is to go to the server task where it identifies the query you are running and browse for it.  Usually the query would fail, so not sure why it is running unless there is any secondary action or query that it is running.  So it has to be running something.  You might be able to locate it from sql tables.  Validate the table names, because depending on version of epo, they may or may not end in mt. 

Select groupid, userid from orionquerymt where name like '%keyword%'

One of the things I noticed is that the name column doesn't list it as displayed in the console.  example - agent handler status query is listed as agent.handler.status, so you might need to modify your keyword to something that the name contains unique to other queries.

Once you get the groupID, you can run select * from orionquerygroupsmt where id = 'id from other query'.

You can identify the user that owns the query by running similar query - select * from orionusersmt where id='userid from other query'

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

9 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: Cannot find query in ePO report

Jump to solution

Is the other admin around still?  It could be a private query or query group.  See kb85359 as an example of issues with that situation. 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Cannot find query in ePO report

Jump to solution

I have logged in at the other admin and the particular query is nowhere to be found.

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 4 of 10

Re: Cannot find query in ePO report

Jump to solution

For that server task, who is showing as the owner of that task?  It may be that someone else has that as a private query. 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Cannot find query in ePO report

Jump to solution

It shows me as the owner.  The query has to exist somewhere because a task that runs based on that query runs weekly.  However, when I look at the Server Task details, it display Invalid Query.

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 6 of 10

Re: Cannot find query in ePO report

Jump to solution

Ahh, then if it says invalid query, that query either has been moved, renamed, or deleted.  You would need to recreate the query or point it to a different one that has the desired results.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Cannot find query in ePO report

Jump to solution

But the query and the server task run successfully??? I get data bck from the query

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 8 of 10

Re: Cannot find query in ePO report

Jump to solution

what I would suggest is to go to the server task where it identifies the query you are running and browse for it.  Usually the query would fail, so not sure why it is running unless there is any secondary action or query that it is running.  So it has to be running something.  You might be able to locate it from sql tables.  Validate the table names, because depending on version of epo, they may or may not end in mt. 

Select groupid, userid from orionquerymt where name like '%keyword%'

One of the things I noticed is that the name column doesn't list it as displayed in the console.  example - agent handler status query is listed as agent.handler.status, so you might need to modify your keyword to something that the name contains unique to other queries.

Once you get the groupID, you can run select * from orionquerygroupsmt where id = 'id from other query'.

You can identify the user that owns the query by running similar query - select * from orionusersmt where id='userid from other query'

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Cannot find query in ePO report

Jump to solution

Thank you. That was very helpful.  I had the wrong user name.

Tom

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 10 of 10

Re: Cannot find query in ePO report

Jump to solution

Good deal, glad to assist!

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator