Computer & Program Filters

Overview

Filters are listed on the left hand side of both the Computers and Programs windows. They are used to filter the display of these windows, allowing an Administrator to quickly find and focus on only certain items.

Each record in the Programs window potentially represents an aggregate of several individual program versions. A search filter looks for satisfaction based on ALL the individual versions within the aggregate. This can sometimes lead to confusing results.

For example, compare a [search for all programs that ARE published by Microsoft] with a [search for all programs NOT published by Microsoft]. Chances are that there exist program line items (i.e. program variants listed in the Programs window) that satisfy both searches! All it takes is a variant that includes one program version with Microsoft in the publisher field while a second program version (aggregated into the same variant) has no publisher in the publisher field.

With KeyConfigure 6.0.0.9 and later, filters can also be used to restrict the scope of reports. With a filter selected, right-click to see the drop down menu which includes a list of all the reports that will accept the selected filter as a restriction. For example, a program filter can be used to restrict any report that deals with programs (e.g. a report whose detail lines are programs).

Filters can be applied to the main window by clicking just to the left of the filter you wish to apply. Doing so will change which programs or computers are displayed in the main window. You can also double-click a filter, which will open up a new window that will display only the filtered items. This window will not have the left-hand section which the main window has. You can edit a filter by right-clicking on it and selecting Edit Filter ... Doing so will open a dialog box to specify the values for the filter.

Check marks are used in each pane of the Display column (left side of the window) to activate individual Filters, Divisions, Folders, Actions, or Login status. A combination of check marks will select all items that match at least one check marked condition in every pane that is used for the selection (e.g. has at least one check mark). This means that when a pane is being used for selection (so it has at least one check mark), an additional check mark will generally increase the number of items displayed as a match. If an additional pane is activated for the selection (by adding a check mark to a pane that had none), then the number of items displayed as a match will generally decrease.

Filter Dialog

There are two different ways of specifying a filter - either with Match These Values or with Match This Filter. Using Match These Values is the simplest method - there is a graphical interface which shows the various values you can specify. These values correspond to various fields in the underlying database, but it is not necessary to understand the database in order to create a filter - the graphical interface is largely self-explanatory. Specifying multiple values means that all the fields must much your criteria - that is, the conditions which you specify in the graphical interface are combined using the "AND" operator.

However, there are reasons for using the Match These Values option. It allows you to specify less common fields, which are not shown in the graphical interface of the filter dialog. Also, it allows you to specify multiple values for the same field, or use boolean logic beyond simply the "AND" operator.

If you start out by choosing various conditions in the Match These Values section, and then change to Match This Filter, you will see a text representation of the filter you have specified. The basic format is a series of conditions in parenthesis, separated by " && ". Each condition involves one field name and one constant. There are multiple ways of referring to a particular field. For example, in a program filter, the field which contains the date on which a program was discovered can be specified by "Discovered" or "programDiscovered". Here is a list of rules for writing filters.

• Each condition should be surrounded by parenthesis.
  
  
• Each condition should involve one field and one constant.
  
  
• For a list of possible fields, see:
  • KSComputers Table Description - for computer filters
  • KSPrograms Table Description - for program filters

  In the filter string, you can use columns from the appropriate table, but you should drop the “computer” or “program” prefix. e.g. instead of “computerFreeSpace”, use “FreeSpace”. Most fields will work in the filter string, but a few may not.

  
  
• Constants should match the type of the field they are being compared to. There are three different types of constants:
  • Numbers are specified simply by typing them without any special escape sequence - e.g. (FreeSpace>10000). They can also be specified using standard hex syntax - e.g. (ClientVersion>=0x6008)
  • Strings must be surrounded by either single or double quotes - e.g. (Notes="special"). A backslash can be used to escape a single or double quote within the string constant - e.g. (Name="Bob\'s Computer"). A literal backslash must be escaped by a second backslash, e.g. ("\\WINDOWS\\"~=Path)
  • Dates are specified using "General Time Format". This format is either:
    • @yyyymmddhhmmssZ - the specified date/time in the local timezone - e.g. @20040122154655Z
    • @yyyymmddhhmmss+oooo - the specified date/time with the specified offset from GMT - e.g. @20040122154655+0400 (the time specified is four hours later than GMT)
    • @yyyymmddhhmmss-oooo - the specified date/time with the specified offset from GMT - e.g. @20040122154655-1000 (the time specified is ten hours earlier than GMT)
      
      
    e.g. (Discovered>@20040122154655Z)
    
    
• You may also compare a field to "NULL" - this means the field has no value. e.g. (LastAudit=NULL) specifies that the LastAudit field has no value (which will be the case if a computer has never been audited).
  
  
• The following types of comparisons can be performed:
  • (field=value) - field is equal to value
  • (field!=value) - field is not equal to value
  • (field>value) - field is greater than value
  • (field>=value) - field is greater than or equal to value
  • (field<value) - field is less than value
  • (field<=value) - field is less than or equal to value
  • ("value"~=field) - text field contains "value"
  • ("value"*=field) - text field starts with "value"
  • ("value"%=field) - text field ends with "value"
    
    
• Conditions can be combined using boolean logic and nested parenthesis
  • !(condition) - negate a condition
  • (condition1) && (condition2) - AND of two conditions
  • (condition1) || (condition2) - OR of two conditions

Here are some complex examples:

• (LastLogin<@20060315120000Z) && ((LastUser="lab user") || (LastUser="anonymous")) - selects computers which have not had someone login since 12:00:00 on March 15, 2006, and where the last user was either "lab user" or "anonymous"
  
  
• (LastAudit=NULL) && (Audit=1) && (ClientVersion>=0x6008) - selects computers which are set to be audited, but have never completed an audit, where the client version is at least 6.0.0.8
  
  
• (Audit=1) && (LastLogin>@20060401080000Z) && ((LastAudit=NULL) || (LastAudit<@20060101120000Z)) - selects computers which are set to be audited and have logged in after 8:00 on April 1, 2006, but have either never completed an audit, or have not completed an audit since January 1st, 2006
  
  
• (Platform=Windows) && (Path!="") && (!("C:"*=Path)) - selects windows programs where the sample path is not empty, but the sample path doesn't start with "C:"

Related Topics