Finding App Launch Instances on Endpoints with ControlUp API

A user asked how to find the number of instances of an app launched on endpoints over a specific period of time. Another user provided a Powershell script that can be used to retrieve this information from the ControlUp API. The script can be modified to change the start and end date-times. The response also included a screenshot of the values for "citrix.desktopviewer.app.exe" for a demo tenant.

Read the entire ‘Finding App Launch Instances on Endpoints with ControlUp API’ thread below:

Good morning. I’m trying to find how many instances of an app is launched on endpoints (Citrix Workspace) over a specific period of time. I’m looking at the "Application Usage Statistics", but that appears to be showing all versions and doesn’t appear to be returning all of the records (24 records over the last 7 days). I just need a total count of how many times Workspace was launched over the last week but all endpoints. Is there a script that I should be looking at instead? Thank you in advance for the assistance.

I took Top Users By Application as a starting point. Taken the query to Powershell and replaced the cookie token with a API key header. Replaced acme.sip.controlup.com/ with api.controlup.com/edge/. Changed the maximum results from 15 to 5000. If you need more feel free to change the 5000 value to up to 60000. If you need more than that, let me know. We’ll have to take it offline.

Last but not least changed the grouping on username to _device_name.

“`$APIKey = "your API key here" ## see https://api.controlup.io/reference/how-to-create-api-keys#dex-platform-vdi–daas-and-edge-dx

$AllProtocols = [System.Net.SecurityProtocolType]’Ssl3,Tls,Tls11,Tls12′

[System.Net.ServicePointManager]::SecurityProtocol = $AllProtocols

$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession

$session.Headers["content-type"] = "application/json"

$session.Headers["accept"] = "/"

$session.Headers["authorization"] = "Bearer $APIKey"

$response = Invoke-RestMethod -UseBasicParsing -Uri "https://api.controlup.com/edge/api/dal/process_stops" `

-Method "POST" `

-WebSession $session `

-ContentType "application/json" `

-Body "{"data_query":{"size":0,"query":{"bool":{"should":[],"must":[{"range":{"stoptime":{"format":"strict_date_optional_time","gte":"2025-01-01T05:00:00.000Z","lte":"2026-01-01T04:59:59.000Z"}}},{"bool":{"should":[{"match_phrase_prefix":{"processname":"Citrix.DesktopViewer.App.exe"}},{"wildcard":{"processname":"Citrix.DesktopViewer.App.exe"}}]}},{"match":{"hasaforegroundwindow":{"query":true}}}],"must_not":[{"match_phrase":{"username":"NT AUTHORITY"}},{"match":{"ispartial":{"query":true}}}]}},"aggs":{"resultset1":{"terms":{"field":"_device_name.keyword","size":5000,"order":{"_count":"desc"}}},"proc_names_agg":{"terms":{"field":"processname.keyword"},"aggs":{"version_agg":{"terms":{"field":"processfileversion.keyword"}}}},"avg_avg_working_set_agg":{"avg":{"field":"averageworkingset_long"}},"max_peak_working_set_agg":{"max":{"field":"peakworkingset"}}}},"device_query":null,"export":false}"

$response.aggregations.resultset1.buckets | ogv“`

Oh I forgot to mention. The start/end date-times are hard coded. But you can modify that with Powershell as well

citrix.desktopviewer.app.exe values for my demo tenant

Amazing! Thank you so much. I’ll give this a shot shortly. Thank you for your time.

Continue reading and comment on the thread ‘Finding App Launch Instances on Endpoints with ControlUp API’.  Not a member? Join Here!