Creating Groups Based on Search Queries

Is there a way to explore all the "Search Queries" tags and values that can be used in creating a scope for a group (or an alert)?

I want to create a group of all windows servers, and this is proving not to be an easy task.

What fields hold the attributes for operating system, platform, and platform family that I see in entity explorer in the image below?

Since I'm struggling determining these, I thought it would be great to go ahead and list all the tags and values for future reference.

I feel silly having to ask this question, but the answer isn't coming to me through trial and error.

Thanks!

Find more posts tagged with

Observability

Comments

jere557

Usually if there's a dropdown to select, like Operating System or Vendor, then in the blank field where you would type, it will give you a list of everything it knows for that dropdown type (Like Vendor in the dropdown and then it will give you an autofill list of all the known items in the Vendor column in the DB, sometimes you may need to click into the blank field and then tap down twice on your keyboard, or backspace twice, and then the results will pop up for you to autofill.

It looks like from that specific screenshot you sent, you can get that info from the Node -> Asset Inventory -> System Information fields in the Orion Scope of the alert. Just go to Browse all fields, and then you'll be able to follow that tree.

simmsd

Thanks for the quick response! All the screen shots you have provided are from the on prem hosted solution of Orion, like SAM. I'm struggling finding the equivalent to explore all the tags with values in the Observability SaaS offering. If you look below there are multiple fields listed as "attributes" under "Search Query", but I cannot find a way to get the listing of all attributes and values without trial and error. There must be a way to view these attributes per entity in SWO SaaS, but I'm struggling to find it.

jere557

Ah dang, I didn't realize this was for the SaaS, I just saw it pop up in the general forums.

Lofstrand

No I don't believe there is a way to display all attributes an entity has.

When it comes to finding all "Windows Servers", in your example. The attribute to look for can vary depending on how the server got into SWO.

For example, if it's an APM server, then you can use apm.osType:windows
If it's from an integration to Self-Hosted, then nc.vendor:Windows give you the info

A way to get all the nodes from various sources seems to be to use <strong>osType:~indows</strong> or osType:[Windows,windows] . This due to "Windows" being stores with both W and w in different situations.