How to filter on a collection's field or property when quering on inventory table (Nexthink's nql)

Question

Suppose I am trying to filter out based on gpus's field/property. Which is a collection of device namespace.

I have a query, which gives results: (so i believe it's syntactically and semantically correct)

devices | where gpus != null | list gpus

and get results like:

gpus
Nvidia xyz
GeForce abc; ASUS GTx

But none of the query gives a result:, why?

devices | where gpus == "*Nvidia*" | list gpus or

devices | where gpus == "Nvidia xyz" | list gpus

Answer 1

Yes, all the three queries below are syntactically and semantically correct. These work fine for me and return accurate results.

devices | where gpus != null | list gpus
devices | where gpus == "*Nvidia*" | list gpus
devices | where gpus == "Nvidia xyz" | list gpus

I suggest checking out the documentation for comparison operators and verify if your gpu name has spaces or her special characters, hence not returning any results. Even in that case the second query should return results, so I am curious what the difference is. Keep us posted.

Answer 2

gpus is a collection of JSON objects stored as string in DB. So, while querying on the collection field either pass the entire json collection as string or can use regular expression to query like below:

devices | where gpus == "*Nvidia*" | list gpus