Using the Question Results grid

In the Question Results grid, an answer row is an aggregation of the endpoints that responded with the data shown. The Count column shows the number of Taniumâ„¢ Clients with that answer.

Figure  1:  Question Results grid

The grid displays the first 100 answer rows. You can change the number of rows in user preferences. Go to the logged in user link in the upper right corner, and select Preferences to display the configuration page.

Enable/disable live updates

As results come in, Live Updates in the Question Results grid toolbar shows the percent of Tanium Clients that have reported results.

Click the pause button to pause updates to the grid.
Click the play button to resume updates to the grid.

Even when 100% of Tanium Clients have reported, you might see answer rows that seem to indicate incomplete results.

[no results]

Indicates that the Tanium Client was instructed to answer but does not have a value that matches the sensor filter. This can be expected when a filter is applied to the get clause and not the from clause. For example, if the question is formed with the syntax Get IP Address ending with 2 from all machines, all machines would report answers and all machines that did not have IP address ending in 2 would report no results. It is better to put the filter in the from clause. For example, Get IP Address from all machines where IP Address ends in 2 would not return unexpected "no results" rows. You might also see [no results] if the sensor does not return a value, or the sensor was unable to execute the script.

[Current Result Unavailable]

If it takes the client longer than usual to evaluate a sensor, it might pass "current result unavailable" to its peer. The sensor process continues on the client, and when it is complete, the client sends its updated answer. The Tanium Console then updates the Question Results grid.

[Results Currently Unavailable]

Indicates the Tanium Server cannot correctly parse an answer. If this occurs, contact your technical account manager (TAM).

Manage rows and columns

Filter results

Use the filter controls to display only rows that match the specified criteria.

Figure  2:  Question Results grid filters

The Question Results grid includes multiple grid filters. The filters are combined as a Boolean AND. For example, if you select a computer group filter, and you also configure an advanced filter, the logic of the filters is combined.

Use a text filter

When you use the Filter By Text field, the Tanium Server filters the Question Results grid without reissuing the question. Select the Contains or Does not contain operator, enter a search string, and click Search .

Use a computer group filter

When you use the Computer Group drop-down list, the Tanium Server issues a new question with the added filter. Select All Computers, No Computers, a user-configured computer group, or the Create Ad Hoc Filter option, which enables you to create a custom filter. If the list of computer groups is long, you can use the text filter within the Computer Group drop-down list to filter by group name. If you save the question, the question text includes the Computer Group filter but not the text filter within the drop-down list.

The list of computer groups includes all computer groups configured in the Tanium Console, even ones for which you do not have computer group management rights. However, if you select a computer group for which you do not have management rights, the new question returns no results.

Use an ad hoc filter

The Ad Hoc filter is a one-time only filter. The Ad Hoc filter configuration is not saved.

  1. Select Create Ad Hoc Filter from the Filter by Computer Group drop-down list.

    Interact displays the Group Builder dialog box.

  2. Use one of the tabs to create a filter and then click Apply.

    The Filter Bar tab includes a natural language parsing search box that helps you build a valid filter expression.

    The Filter Builder tab includes fields that enable you to add a filter, apply it, and issue the resulting question. The question is always Get computer name and IP address from all machines with the filter added to the from clause.

    The Manual List tab includes fields that enable you to specify a list of computers by hostname or IP address.

Use an advanced filter

Use advanced filters to match conditions, including column values.

  1. Click Advanced Filtering to reveal the user interface.
  2. Click + and use the controls to add filter conditions:
    • Add Row

      Add one or more conditions.

    • Add Group

      Select this option to nest a Boolean operator and then use Add Row to build the nested expression.

    The grid is redisplayed when you click Apply.

Sort results and select columns to view

In column headers, click the menu icon to display the menu for sorting rows and showing/hiding columns. Click the Clear Sort button to clear sorting criteria.

Figure  3:  Grid row/column controls

View charts

The results grid is the default view. You can use the View button bar to toggle to a pie chart or bar chart.

Mouse over a pie slice or bar to display the result string and count. If the result count is less than 3 % of the total, it is included in the Other group.

Figure  4:  Pie chart

Figure  5:  Bar chart

Export and copy results

The Question Results page provides several options for copying and exporting the results grid contents. The following figure shows the buttons and menu selections for exporting (2) or copying (3) the entire grid contents or specific results (1).

Figure  6:  Copy or export question results
Use the Copy Table icon to copy the results to the clipboard in text format. This action copies the complete results, not just the results displayed on the Question Results grid. To include sensor/column names in the copied text, see Set user preferences.
Use the Export Table icon to export the results to a .csv file. This action exports the complete results, not just the results displayed on the Question Results grid. To include sensor/column names in the .csv file, select Include Table Headers. To set this option as enabled or disabled by default, see Set user preferences.

Select how the .csv file displays results for questions where a single sensor generates multiple results for each responding endpoint. As an example, for the question Get Computer Name and High CPU Processes[5] from all machines, the High CPU Processes sensor would list five processes for each endpoint.

  • Single Rows - Flattened: Display a row for each result that a sensor generates. For the example question, this would mean five rows per endpoint: one row for each process that the High CPU Processes sensor returned. Note that this option works only if one sensor in the question has multiple results; flattening does not work if multiple sensors each have multiple results.
  • Multiple Lines Per Row - Stacked: Display one row for all the results that the sensor generated for an endpoint. For the example question, this would mean each row lists all the top five processes for each Computer Name.
Select one or more rows and use the More selector to copy or export only the selected rows.
Alt/Option key To copy the contents of a grid cell, press the Alt key (Windows) or Option key (macOS) and click in the grid cell. A blue toast message tells you that the clipboard has a copy of the cell contents. This operation works for most grids in the Tanium Console, including the Question Results grid.

Merge questions

Question results often lead to additional questions. For example, say you originally ask for a list of computer names and running processes, and you see results that indicate a suspicious process is running on a few endpoints. You can merge the question with another to learn more, such as the last logged-in user. The Tanium Server issues the merge question in the background, and the Tanium Console redisplays the Question Results grid with one or more additional columns that have data for the added sensor.

To merge questions:

  1. Click Merge in the upper right corner of the Question Results grid toolbar.

    Interact displays the Select Merge Questions dialog box.

  2. Use one of the tabs to add one or more questions and then click the red Merge button.
    • Saved Questions: Includes a list of saved questions for which you have Read Saved Question permission.
    • Create a Question: Includes fields that enable you to start a new question.
    • Build a Question: Includes fields that enable you to select sensors for the merge question.

      Notice that you add sensors to the get clause but you do not add filters to the from clause. The from clause is built from the rows that you selected in the Question Results grid when you clicked Merge.

Drill down

From the Question Results grid, you can drill down from selected results to retrieve additional information from the selected endpoints. By adding a drill-down question, you are essentially adding sensor filters. You often will want to do this when you are targeting a narrow group of computers for an action. For example, let's say you originally ask for a list of chassis types and operating systems. You can drill down from these results to the list of computer names for the matching records.

To drill down:

  1. Select one or more rows in the Question Results grid. When you select rows, the Drill Down, Deploy Action, and More buttons are displayed.
  2. Click Drill Down.

    Interact displays the Select Drilldown Question dialog box.

    The Saved Questions tab includes a list of saved questions for which you have Read Saved Question permission.

    The Create a Question tab includes fields that enable you to start a new question.

    The Build a Question tab includes fields that enable you to select sensors for a drill-down question.

  3. Select or configure a question you want to use and then click the red Drill Down button.
  4. Interact displays the progression of results, including a new Question Results grid for the drill-down question. From here, you can drill down further, deploy an action, save the question, or copy it to the Question Bar or Question Builder for further refinement.



Last updated: 2/22/2019 1:21 PM | Feedback