Filter devices based on lastSeenBefore

Question

I am following this guide - https://news.sophos.com/en-us/2020/04/28/how-to-remove-unused-devices-from-sophos-central/ 
 No matter what I set find_old to be in terms of days I get all devices in the inventory. In the sample script it is using lastSeenBefore to filter. What am I missing, I only want to retrieve devices that were last seen before say 30 days ago.

rcbolio · Accepted Answer

I had the same issue and discovered this had to do with some of the syntax in the sample script. I changed the page_size under section # Generate urls for tenants to be: 
 page_size = "50&lastSeenBefore={0}&fields=tenant&fields=hostname&fields=id&fields=lastSeenAt&fields=os&fields=type&fields=associatedPerson".format(find_old) 
 Then set find_old to "-P30D." This returned the correct data for me. 
 Thanks 
 Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts If a post solves your question use the 'Verify Answer' link.

Filter devices based on lastSeenBefore

Top Replies