| dbquery mcafee "SELECT DISTINCT UPPER(EPOLeafNode.NodeName) AS Name, EPOLeafNode.LastUpdate AS mcafee_scantime,EPOComputerProperties.DomainName as Domain, EPOLeafNode.AgentVersion, EPOProdPropsView_VIRUSCAN.productversion AS VSEVersion, EPOProdPropsView_VIRUSCAN.enginever, EPOComputerProperties.OSType AS OS, EPOProdPropsView_VIRUSCAN.datver, RTRIM(EPOComputerProperties.userproperty1) AS McAfeeAssetTag, UPPER(EPOComputerProperties.userproperty3) as SerialNumber FROM EPOLeafNode LEFT JOIN EPOProdPropsView_SOLIDCORE ON EPOLeafNode.AutoID = EPOProdPropsView_SOLIDCORE.LeafNodeID LEFT JOIN EPOProdPropsView_EPOAGENT ON EPOLeafNode.AutoID = EPOProdPropsView_EPOAGENT.LeafNodeID LEFT JOIN EPOProdPropsView_VIRUSCAN ON EPOLeafNode.AutoID = EPOProdPropsView_VIRUSCAN.LeafNodeID LEFT JOIN EPOComputerProperties ON EPOLeafNode.AutoID = EPOComputerProperties.ParentID where EPOLeafNode.LastUpdate > DATEADD(MONTH, -1, GETDATE())" | table Name SerialNumber McAfeeAssetTag mcafee_scantime Domain OS AgentVersion VSEVersion enginever datver | eval mcafee_scantime = strftime(mcafee_scantime, "%F") | eval Datasource="Mcafee" | dedup Name | eval_ministries(Domain) | where Ministry ="$Ministry$" | stats count by AgentVersion
Like I said it works if I select the actual ministry just fine.
... View more