fleetdm
Improve breakdown of host counts that respond to a live query
customer-flavia: Slack thread: https://fleetdm.slack.com/archives/C0389SEPLR3/p1733501309669019
- @noahtalerman: User requested this because they want to know how many hosts responded but didn't return any results.
- @allenhouchins: They just don't want to do the math.
- @noahtalerman: In the interim if the query always returns on result per host. Then the user can subtract the number of results from the total hosts targeted. This gets harder when the query returns multiple restults per host.
- @username: Eventually Fleet could show the count of hosts that returned results, count of hosts that didn't, and count of hosts that returned errors. Fleet could put this info in a tooltip here:
User stories
- #24950
Problem
When running a live query in the Fleet UI, a user might see the following breakdown of hosts targeted/responded:
1,261 hosts targeted (36% responded) 373 results
In this scenario, it can be calculated that 454 hosts responded, and 373 produced results. It's not always immediately apparent that hosts responded without producing results when only the percentage of hosts that responded is displayed.
What have you tried?
Fleet admins are able to calculate the number of hosts that responded or didn't respond based on the percentage of the total hosts.
Potential solutions
Instead of showing percentages for hosts that responded, Fleet could display the raw numbers of hosts in each category with more detail:
1,261 hosts targeted 454 responded 373 produced results 81 produced no results 0 produced errors
What is the expected workflow as a result of your proposal?
This is an ease of use improvement and does not enable any workflows that are not possible today.
An example workflow would be that an admin live queries all hosts in their environment. They'd be able to immediately see the raw number of hosts that didn't respond instead of needing to calculate it from the percentage. Additionally, they'd get a better breakdown of hosts that produced results, hosts that responded but produced no results, and hosts that responded but produced an error.
Hey @Patagonia121 heads up that we shipped this improvement in 4.66: see a report of how many hosts responded to a live query with results, no results, and errors:
We think this satisfies customer-flavia's request here. Can you please give the customer a quick demo and ask if Fleet is missing anything?
https://fleetdm.com/handbook/customer-success#communicate-feedback-on-prioritized-customer-requests:~:text=If%20the%20improvements,the%20request%20issue.
@kc9wwh can you make another quick loom for customer-flavia and share this update?
Queries whisper soft, Each host a cloud city light, Counted, not lost in night.
