Jump to content
rshores

Search doesn't return results

Recommended Posts

My apologies if I'm posting this in the wrong place!

 

I'm having what I hope is a stupid issue with a dataview. We're switching AV software on all of our clients, so I thought I'd pull a data view of all software, then be able to restrict it to only show records containing "ESET" (our old software). Here's a screencap of part of what should show up - this view has no searches, and should include everything:

 

 

Next, I tried searching for the values "%ESET%", "ESET%", "*ESET*, and "ESET*" (all without quotes), and retrieved the following set of results (all search terms returned the same):

 

 

I know that there's a search at the bottom of the tree which will show me all of the client computers with any sort of ESET on them, but I thoguht that this would be a good opportunity to try to learn how to use the dataviews (since I obviously have no clue!). I even tried taking the SQL from the AV/ESET search at the bottom of the tree and searching for the same values ('ESET NOD32 Antivirus', 'ESET Smart Security', 'ESET Endpoint%') in a manual search in a dataview, but still no dice.

 

Does anyone have any insight on what I'm doing wrong?

 

Thanks!

59ec943cc7c9f_Screenshot-3_9_20169_37_25AM.png.cc47799b923746e14bce29cbd2c3460e.png

59ec943ccc626_Screenshot-3_9_20169_38_44AM.png.a778391587221f1c9292a4838f010ea3.png

Share this post


Link to post
Share on other sites

I can't replicate this on any of my LabTech installs. Can you search any of the fields/columns? Do other dataviews have the same issue?

Share this post


Link to post
Share on other sites

Curiouser and curiouser.

 

When I search for "3CX" (with no quotes and no wildcards), I get 17 results - all of the machines across our whole enterprise that have the 3CX software installed, and all of the software on our server named "TYSV-3CX". The 3CX software packages that the search is picking up have a couple of different names: "3CX Phone System" and "3CXPhone for Windows" (showing that the search function apparently doesn't care too much about wildcard characters).

 

Searching for "ESET" (with no quotes or wildcards) now returns all of the computers with ESET loaded, plus one computer with Carbonite that doesn't have ESET anywhere in the PC name (gotta take care of that Carbonite stuff now, huh?), and every install of "Microsoft OneDrive" and "Microsoft SkyDrive" (again, with no occurrences of ESET in the names of the PC's.

 

I'm inclined to think that I've got the right idea with the searches, and that it just has some sort of issue with the search term "ESET" for some weird reason. Does that make sense?

 

Thanks!

Share this post


Link to post
Share on other sites

Have you tried to run SQL query through SQLyog ?

Try:

SELECT computers.`name`, software.`Name`, software.`Version`, software.Location, software.DateInstalled, software.Size
FROM software 
JOIN computers ON computers.ComputerID = software.ComputerID
WHERE software.`name` LIKE '%ESET%'

Is there any result?

Share this post


Link to post
Share on other sites

If you see results, try to export to Excel then filter, search and do what do you want there.

 

Ok, here is a query after I added "Client\Location" column in order to sort by client if you want in Excel:

 

SELECT 'Client', 'Computer Name', 'Software Name', 'Version', 'Location', 'Date Installed' UNION ALL
SELECT CONVERT(CONCAT(clients.name,' / ',locations.name) USING utf8) AS 'Client', computers.`name`, software.`Name`, software.`Version`, software.Location, software.DateInstalled
FROM software 
JOIN computers ON computers.ComputerID = software.ComputerID
LEFT JOIN clients ON clients.ClientID = computers.clientid
LEFT JOIN locations ON locations.LocationID = computers.LocationID
WHERE software.`name` LIKE '%ESET%'
INTO OUTFILE 'C:/Windows/TEMP/ESET.csv'
FIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"'
LINES TERMINATED BY '\n'

 

Then go check C:\Windows\TEMP\ESET.csv on your LT server.

Should look like:

Untitled.png.978b8e3059e2892dbf73034991f96dac.png

Share this post


Link to post
Share on other sites

All I have access to is the LT client, not access to the server itself. Within what I'm able to see (searches, dataviews, etc) I can't find any place to enter the SQL query. I can see the SQL statement that builds the searches, but it's on a read-only popup, and I can't change the SQL statement, or write a new one there.

Share this post


Link to post
Share on other sites

bad :(

Ok, try please another Dataview:

software > Whitlisted Software

or the dataview: Status > Antivirus Status

Then go to search and write: ESET

 

also, go to dataview > Processes > Running Processes

then search for ekrn.exe

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...