QueryDevicesByFilterScroll return duplicates values

[roeiklein]

when using QueryDevicesByFilterScroll the total items are unique?
i am retrieving the total amount but getting duplicates values(199 unique values of total 4300 in the responses).
is there a unique value filter?

https://www.falconpy.io/Service-Collections/Hosts.html#querydevicesbyfilterscroll

thanks

[jshcodes]

Hi @roeiklein -

Results from QueryDevicesByFilterScroll should be unique. Can we see an example of your code so we can try to recreate this?

[roeiklein]

@jshcodes thank you for the fast respond.
this is the python method that I am using for the retrieval of the host's agent IDs. I checked that the offset is different between each response.
maybe I am missing something...

    def get_hosts_agent_id(self):
        host = Hosts(client_id=self.client_id,
                     client_secret=self.client_secret)
        response = host.query_devices_by_filter_scroll()
        retrieved_assets_ids = response["body"]["resources"]
        assets_ids = retrieved_assets_ids
        pagination = response["body"]["meta"]["pagination"]
        total_records = pagination.get("total")
        offset = pagination.get("offset")
        params = {'offset': offset}
        while len(assets_ids) <= total_records:
            response = host.query_devices_by_filter_scroll(params=params)
            retrieved_assets_ids = response["body"]["resources"]
            assets_ids += retrieved_assets_ids
            pagination = response["body"]["meta"]["pagination"]
            total_records = pagination.get("total")
            offset = pagination.get("offset")
            params = {'offset': offset}
            
        return list(set(assets_ids))

[jshcodes]

Hi @roeiklein -

Think I've found the problem.

We're passing params=params in our second call to QueryDevicesByFilterScroll, but the query string parameters dictionary keyword is parameters, this line will need to change to read:

response = host.query_devices_by_filter_scroll(parameters=params)

After making this change your code should execute as expected.

Side note: You do not have to provide a crafted dictionary to the parameters keyword. You can also provide offset as a keyword directly.

response = host.query_devices_by_filter_scroll(offset=offset)

Thank you for the question! 😄

[roeiklein]

@jshcodes thank you very much, that fixed my problem