topic Re: Filtering all hosts NOT in any host group in Open Q&A

Filtering all hosts NOT in any host group

Enrico_F — Thu, 02 May 2024 12:58:10 GMT

I would like to identify all active hosts in my SaaS environment that are NOT members of any host group e.g. as a list of host names.

What would be the easiest way to achieve this preferably via UI or an entity selector?

Re: Filtering all hosts NOT in any host group

Esam_Eid — Thu, 02 May 2024 13:42:11 GMT

Hi @Enrico_F ,

Usually we use Oneagent on a Host API to retrieve all the hosts details including the host group details, then we convert the json to CSV and filter the hosts with empty host group.

Regards,

Re: Filtering all hosts NOT in any host group

Enrico_F — Thu, 02 May 2024 14:21:09 GMT

Thanks @Esam_Eid

I was hoping for a solution that doesn't require external filtering of the response, but it looks like there is none (surprisingly).

FWIW: Another workaround that also requires external response filtering would be going through the "Monitored entities" API via an entity selector like "type(HOST)" and filtering the response for hosts with an empty object "fromRelationships.isInstanceOf".

As the "OneAgent on a host" API seems painfully slow even without including the details I prefer using the "Monitored entities" API as a workaround for now (unless someone can suggest a better way).

Re: Filtering all hosts NOT in any host group

aeric-walls — Thu, 02 May 2024 18:09:39 GMT

Hi @Enrico_F, I have two ways, with DQL this is very easy to get the list and export to a CSV file.

fetch dt.entity.host | filter isNull(hostGroupName)

I'd suggest running this free DQL query in a notebook and an export to CSV option will appear.

That is all purely UI, no settings changes or API usage. If you're open to creating an auto tag in the UI, you could create a tag that tags hosts without host groups, then with the monitored entities API, use an entity selector like:

type(HOST),tag(no-host-group)

This was a mix of demo and personal environments, so I've blocked host names, but trust they are there 😄

Re: Filtering all hosts NOT in any host group

Enrico_F — Fri, 03 May 2024 06:42:32 GMT

Excellent, thanks a lot @aeric-walls !