This content has been marked as final. Show 5 replies
Yeah, I noticed the same thing.
The report values available to you through the new, strange, undocumented query system are the number of managed systems, the number of different values of a given property, or the sum of the numeric values of a given property.
If you edit the default VSE: Dat Deployment report in Query Builder you can see that, although the label for the pie chart is DAT Version, the slice values are actually counting the number of managed systems reporting that DAT version, which explains the screwy ordering.
Changing it to the number of different values of DAT Version obviously won't do what you want either. At that point I decided I could put up with the default report.
I'll have another look at it if I get a bit of time though.
I had a little bit of a go at this today.
I can take the SQL statement for the existing query and slightly modify it in SQL Management Studio to do what you (and I) want, but I've no way of importing that back into the EPO4.0 console so it's an actionable query.
McAfee support say this new xml-based format is proprietary and won't give me any information on it or on the engine that converts between it into SQL. Nor have they a scooby about how to use it themselves.
I've logged an FMR but I've logged those before and ****-all gets done.
Can you please post your modified sql query? I spoke with McAfee support (tier 1) and they had no clue how to even run reports in ePO 4.0!!! 2 hours later he escalated the ticket to tier 2 support to have the report run through crystal reports, then they closed it for some reason today...
It's just the default query but change the order by clause from 'count' desc to [EPOProdPropsView_VIRUSCAN].[datver] and reorder the columns as you see fit. It's that easy in SQL but I still don't see how to do it with this strange Orion query format.
So I talked with support again and they said I can do this if I modify the DAT Deployment Report in xml form which you can export then import when changes are made. But I am having trouble figuring out what to change. Here is the code:
<name language="en">VSE: DAT Deployment</name>
<description language="en">Displays the three highest DAT versions, and a slice for all the other versions.</description>
<property name="tableURI">query:table?orion.table.columns=EPOComputerProperties.ComputerN ame%3AEPOComputerProperties.DomainName%3AEPOComputerProperties.IPV4x%3AEPOLeafNo de.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_ VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VI RUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRU SCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate& ;orion.table.order=az&orion.table.order.by=EPOComputerProperties.ComputerNam e%3AEPOComputerProperties.DomainName%3AEPOComputerProperties.IPV4x%3AEPOLeafNode .os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VI RUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRU SCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSC AN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate</prop erty>
<property name="conditionURI">query:condition?orion.condition.sexp=%28+where+%28+version_ ge+EPOProdPropsView_VIRUSCAN.productversion+%228%22+%29+%29</property>
<property name="summaryURI">query:summary?pie.slice.title=EPOProdPropsView_VIRUSCAN.datve r&orion.show.other.limit=4&orion.show.other=true&orion.sum.aggregati on.column=count&orion.sum.time.cols=false&orion.sum.group.by=EPOProdProp sView_VIRUSCAN.datver&orion.sum.aggregation=count&pie.count.title=EPOLea fNode&orion.sum.limit.count=0&orion.sum.order=desc&orion.chart.type= pie&orion.sum.limit=true&orion.sum.query=true</property>
I know that it lies somewhere within editing the summaryURI property query. I really wish i could import a SQL query instead of this proprietary orion xml crap! I experimented by placing EPOProdPropsView_VIRUSCAN.datver in various places of the statement but to no avail.