topic DQL to get process group for specific set of hosts in DQL

DQL to get process group for specific set of hosts

AK — Mon, 18 Mar 2024 16:49:06 GMT

I need help to get process group for specific set of hosts using DQL.

Has anyone extracted it successfully?

Regards,

Re: DQL to get process group for specific set of hosts

AntonPineiro — Mon, 18 Mar 2024 18:46:45 GMT

Hi,

It returns all process groups IDs and visual name for host "XXXX":

fetch dt.entity.host | filter entity.name == "XXXX" | expand runs[dt.entity.process_group] | fieldsAdd process_group.name = lookup( [ fetch dt.entity.process_group ], lookupField:id, sourceField:`runs[dt.entity.process_group]` )[entity.name]

Maybe a better DQL query can be done.

Best regards

Re: DQL to get process group for specific set of hosts

krzysztof_hoja — Mon, 18 Mar 2024 20:29:11 GMT

As single process group can run on multiple hosts, this query may contain duplicates, you can use dedup command

| dedup `runs[dt.entity.process_group]`, process_group.name

to get list of unique process group ids/names and one exemplary host id/name for each of them. Alternatively you can use summarize to get unique process group ids/names with array of hosts it runs on

| summarize {ids=collectDistinct(id)}, by: {`runs[dt.entity.process_group]`, process_group.name}

Kris

Re: DQL to get process group for specific set of hosts

DineshP — Sun, 16 Feb 2025 16:21:06 GMT

Hi @krzysztof_hoja / @AntonPineiro

Good Day!

I am trying to fetch the software technologies of the process group. Could you please help me achieve this?

Thanks!

Re: DQL to get process group for specific set of hosts

gdalessandro — Tue, 01 Apr 2025 19:45:08 GMT

I used this query to successfully get a list of processes that have a specific one agent version installed on them.

fetch dt.entity.process_group_instance
| fieldsadd host_id=belongs_to[dt.entity.host]
|join[fetch dt.entity.host | filter contains(installerVersion, "1.307") | fieldsAdd installerVersion], on:left[host_id] == right[id]

I would think that something like this should give you what you are after:

fetch dt.entity.process_group_instance
| fieldsadd host_id=belongs_to[dt.entity.host]
|join[fetch dt.entity.host | filter dt.entity.host in (host1, host2,hoste) ], on:left[host_id] == right[id]