---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# CIM probe

# CIM probe {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read

The CIM probe uses WBEM protocols to query a particular CIM server, the CIM Object Manager, for a set of data objects and properties. {#r_CIMProbe__ph_cim-probe-intro}
For instructions on configuring probe parameters, see [Set probe parameters](https://servicenow-prod.fluidtopics.net/UHZBnXmoydOuoy0I74kSWA "Use probe parameters to control the behavior of a particular probe every time it is triggered.").
The following parameters may be passed to the CIM probe:
{#r_CIMProbe__table_s1j_w2v_m4__entry__3}

| Parameter | Description | Default Value |
|-|-|-|
| source | \[Required\] The initial host to connect to. | None |
| port | The port to connect to. If empty, the value is determined by the "schema" parameter: http = 5988, https = 5989. | 5988 or 5989 |
| schema | \[Required\] The schema to use: '"http"' or '"https"'. | http |
| namespace | \[Required\] The CIM namespace. May be overridden by a query. | None |
| queries | \[Required\] A semicolon-delimited list of CIM probe queries to process and return results for. | None |
| retries | The number of times to retry a query if it fails due to network connectivity issues. | 2 |
| connection_timeout | The number of milliseconds the probe has to connect to a server. | 5000 |
| socket_timeout | The number of milliseconds the probe has to read data. | 5000 |
[Table 1. CIM Probe]

{#r_CIMProbe__table_s1j_w2v_m4}

The CIM Intermediate Query Language (CimIQL) uses keys, filters, and dot-walking to
traverse the CIM schema.

## Parameter Expansion {#r_CIMProbe__section_mvx_ncg_dcb}

The CIM query language supports standard SNC preprocessed probe parameter expansion. Place
variables in queries by encapsulating their names like this:  

    ${foobar}.CIM_RunningOS[0].Name
    CIM_ComputerSystem.${barfoo}

The text ${foobar} is replaced with the contents of the foobarprobe parameter passed to the
CIM probe; likewise for barfoo.

## CIMIQL {#r_CIMProbe__section_wyd_pcg_dcb}

The CIM Intermediate Query Language (CimIQL) is an intermediate language designed to simplify the process of querying CIM providers. {#r_CIMProbe__ph_cim-query-lang-intro}

CimIQL currently supports the standard Web-Based Enterprise
Management (WBEM) protocol stack, but others, such as Web Services-Management (WS-MAN), may
be added in the future. The query language syntax borrows from elements of Microsoft's WMI query language and UNIX's wbemcli command. The CimIQL
library is a pure Java implementation.{#r_CIMProbe__p_cimiql-content}  
Note:  
CimIQL is pronounced "simicle".

## CimIQL syntax {#ariaid-title2}

CimIQL syntax consists of several elements, including a query and different
tokens.
{#r_CimIQLSyntax__table_drq_3vc_lp__entry__2}

| Element | Description |
|-|-|
| Statement | The most basic element of CimIQL is a valid . A statement contains multiple queries delimited by a period . character. |
| Query | A represents a single high-level protocol-independent request. Each query is comprised of nested language components and sub-components known as tokens. |
| Token | A describes a specific lexical aspect of the CimIQL syntax. |
| [Operation Token](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens "The CimIQL probe requires operation tokens.") | The first token of each query must be an , which represents the overall logical operation to be performed. |
| [Component Token](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens "The CimIQL probe requires component tokens, which are sub-components of operational tokens.") | A is a sub-component of an operation token. |
| Result | Each query is paired with a result, which is then provided as input to the next query in the statement. A is comprised of a set of objects and their properties. |
[Table 2. CimIQL Syntax Element Descriptions]

{#r_CimIQLSyntax__table_drq_3vc_lp}

## CimIQL operation tokens {#ariaid-title3}

The CimIQL probe requires operation tokens.
Each of the following core operations has a counterpart in the [CIM Operations over HTTP](http://www.dmtf.org/sites/default/files/standards/documents/DSP0200_1.3.1.pdf) standard.  
{#r_CimIQLOperationTokens__table_rk1_jzc_lp__entry__3}

| Return Value | Details | Equivalent CIM Operation over HTTP |
|-|-|-|
| class object | [Get Object](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__GetObjectToken) Retrieves a single object of a specific class by specifying all of its unique keys (as [key tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__KeyToken)) and any optional [parameter tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__ParameterToken), separated by commas. | GetInstance |
| class object | [Enumerate Objects](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateObjectsToken) Retrieves objects that match a set of [condition tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__ConditionToken) and [parameter tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__ParameterToken). | EnumerateInstances |
| class object | [Enumerate Associated Objects](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateAssociatedObjectsToken) Retrieves objects associated with each result from the preceding query. | Associators |
| statement results | [Substitution](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__SubstitutionToken) A no-op token that feeds the results of a previous named statement as input into the next query of its own statement. | Reference the results of a named statement |
[Table 3. CimIQL Operation Token Summary]

{#r_CimIQLOperationTokens__table_rk1_jzc_lp}

### Get Object Token

\<classname\>{\<key token\>,\<parameter token\>,...}

* Retrieves a single object of a specific class by specifying all of its unique keys (as key tokens [key tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__KeyToken)) and any optional [parameter tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__ParameterToken), separated by commas. This token is also known as the .
* The \<classname\> is the case-sensitive CIM class name of the desired object. By default, objects of the specified class and of any extended classes are retrieved.
* The key and parameter tokens are enclosed by a single pair of curly brackets { ... }.
* This token must only be used as the first query in a statement.
* Returns: class object
* Example:

      CIM_ComputerSystem{CreationClassName='Linux_ComputerSystem',Name='runtime'}.*

{#r_CimIQLOperationTokens__ul_ibd_vcd_lp}

### Enumerate Objects Token

\<classname\>{{\<condition token\>,\<parameter token\>,...}}\<array index token\> OR \<classname\>\<array index token\>

* Retrieves objects that match a set of [condition
  tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__ConditionToken) and [parameter
  tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__ParameterToken). This token is also known as the .
* The condition tokens and parameter tokens are enclosed by two pairs of curly brackets {{ ... }}. The curly brackets are optional if there are no conditions or parameters necessary.
* The \<classname\> is the case-sensitive CIM class name of the desired objects. By default, objects of the specified class and of any extended classes are retrieved.
* The [index
  token](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__IndexToken) is optional.
* This token must only be used as the first query in a statement.
* Returns: class object
* Example:

      CIM_ComputerSystem{{Name!='runtime'}}.*

{#r_CimIQLOperationTokens__ul_rlm_zdd_lp}

### Enumerate Associated Objects Token

\<association classname\>{{\<property filter token\>,\<parameter token\>,...}}\<array index token\> OR \<association classname\>\<array index token\>

* Retrieves objects associated with each result from the preceding query.
* The [condition tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__ConditionToken) and [parameter
  tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__ParameterToken) are enclosed by two pairs of curly brackets {{ ... }}. The curly brackets are optional if there are no properties filters or parameters necessary.
* The \<association classname\> is the name of the many-to-many or one-to-many class that associates two objects together. By default, objects of the specified class and of any extended classes are retrieved.
* The \<parameter token\>, ResultClass, may be specified to filter results based on the resulting object's classname.
* The [index
  token](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__IndexToken) is optional.
* This token must not be used as the first query in a statement.
* Returns: class object
* Example:

      CIM_ComputerSystem{{Name='runtime'}}[2].*

{#r_CimIQLOperationTokens__ul_c1c_p2d_lp}

### Substitution Token

${\<statement name\>}

* A no-op token that feeds the results of a previous named statement as input into the next query of its own statement.
* Returns: void
* Example:

      $(lastComputer).ElementName

{#r_CimIQLOperationTokens__ul_fz3_tgd_lp}

## CimIQL component tokens {#ariaid-title4}

The CimIQL probe requires component tokens, which are sub-components of operational
tokens.
The following tokens are sub-components of [operation tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens "The CimIQL probe requires operation tokens.").{#r_CimIQLComponentTokens__table_rk1_jzc_lp__entry__2}

| Token | Details |
|-|-|
| Properties token | \* OR \<property name\>,\<property name\>,... Specifies which properties are to be returned for each object of the final result set. |
| Query Delimiter Token | . (Period) Separates queries. |
| Index Token | \[index\] Reduces a preceding query's results to a single object at the specified integer index. |
| Key Token | \<key name\>='\<value\>' Matches an object property designated as a key by exact value. |
| Condition Token | \<property name\>\<conditional operator\>\<enclosed value\> Matches a single property of an object based on the condition specified. |
| Parameter Token | \<parameter name\>:'\<value\>' Passes a parameter by \<parameter name\> to the operation being called. The parameter may be consumed during CimIQL pre-processing or by the CIMOM via request, depending on the parameter. |
[Table 4. CimIQL Component Token Summary]

{#r_CimIQLComponentTokens__table_rk1_jzc_lp}

### Properties Token

\* OR \<property name\>,\<property name\>,...

* Specifies which properties are to be returned for each object of the final result set.
* The wildcard \* returns all properties available. Otherwise, each property name desired is provided within a comma-separated list.
* This token is required at the end of each statement.
* Example:

      CIM_ComputerSystem[0].*

{#r_CimIQLComponentTokens__ul_kt1_pkd_lp}

### Query Delimiter Token

. (Period)

* Separates queries.
* Example:

      CIM_ComputerSystem.PrimaryOwnerContact

### Index Token

\[index\]

* Reduces a preceding query's results to a single object at the specified integer index.
* This token is always optional.
* Example:

      CIM_ComputerSystem[0].*

{#r_CimIQLComponentTokens__ul_tkg_1ld_lp}

### Key Token

\<key name\>='\<value\>'

* Matches an object property designated as a key by exact value.
* The \<key name\> is the name of the property used as a key.
* Example:

      CIM_ComputerSystem{CreationClassName='Linux_ComputerSystem',Name='runtime'}.*

{#r_CimIQLComponentTokens__ul_mw1_tld_lp}

### Condition Token

\<property name\>\<conditional operator\>\<enclosed value\>

* Matches a single property of an object based on the condition specified.
* The \<property name\> is the name of the property to match against.
* The \<conditional operator\> determines how the property's actual value is compared to its expected value. The operators available are equality (=) and inequality (!=).
* The \<enclosed value\> should be one of the following:
  * Literal value enclosed in single-quotes ' ... '. For example, foo='bar'
  * Regular expression, enclosed by a pair of slashes / ... /. For example, foo=/bar.\*/
  {#r_CimIQLComponentTokens__ul_hpg_zld_lp}
* Example:

      CIM_ComputerSystem{{Name!='runtime'}}.*

{#r_CimIQLComponentTokens__ul_lv3_yld_lp}

### Parameter Token

\<parameter name\>:'\<value\>'

* Passes a parameter by \<parameter name\> to the operation being called. The parameter may be consumed during CimIQL pre-processing or by the Common Information Model Object Manager (CIMOM) via request, depending on the parameter.
* Example:

      CIM_ComputerSystem.CIM_RunningOS{{ResultClass:'Win32_ComputerSystem'}}.*

{#r_CimIQLComponentTokens__ul_i4g_mmd_lp}

## CimIQL tutorial {#ariaid-title5}

This is a tutorial by example where each example builds on the previous
example.
{#r_CimIQLTutorial__table_e4t_35d_lp__entry__3}

| Order | CimIQL Statement | Result |
|-|-|-|
| 1 | CIM_ComputerSystem\[0\].\* | Retrieves the [first result](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__IndexToken) of all instances of CIM_ComputerSystem and its descendants. Retrieves all [properties](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__PropertiesToken). |
| 2 | CIM_ComputerSystem.PrimaryOwnerContact | Retrieves all instances of CIM_ComputerSystem and their descendants. Retrieves only one [property](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__PropertiesToken), PrimaryOwnerContact. |
| 3 | CIM_ComputerSystem{CreationClassName='Linux_ComputerSystem',Name='runtime'}.\* | Retrieves a single unique instance of CIM_ComputerSystem and its descendants. All [key tokens](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__KeyToken) must be specified within the { } [identity token](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__GetObjectToken). |
| 4 | CIM_ComputerSystem{{Name!='runtime'}}.\* | Retrieves all instances and descendants of CIM_ComputerSystem that do not have a Name [property](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__PropertiesToken) of 'runtime'. The [filter token](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateObjectsToken) {{ }} filters out instances that do not contain all of the properties/keys specified. |
| 5 | CIM_ComputerSystem{{Name=/\^run.\*$/}}.\* | Retrieves all instances and descendants of CIM_ComputerSystem that have a value matching the regular expression contained within the / / characters. Note: The regular expression does not require single quotations. The [filter token](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateObjectsToken) {{ }} filters out instances that do not contain all of the properties/keys specified. |
| 6 | CIM_ComputerSystem{{Name='runtime'}}\[2\].\* | Retrieves the [second result](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateAssociatedObjectsToken) of all instances of CIM_ComputerSystem and its descendants [where](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateObjectsToken) the instances have a property Name of 'runtime'. The order of operations follows the query syntax. 1. [Query](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__GetObjectToken) server for all CIM_ComputerSystem and descendants. 2. [Filter](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateObjectsToken) results based on Name property. 3. [Retrieve the second](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateAssociatedObjectsToken) instance that passed the filter. {#r_CimIQLTutorial__ol_x1l_zxd_lp} |
| 7 | CIM_ComputerSystem.CIM_RunningOS\[0\].Name | Retrieves the Name [property](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__PropertiesToken) for the first CIM_OperatingSystem instance of each CIM_ComputerSystem instance. The middle-token, CIM_RunningOS, is the name of the [Associator class](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateAssociatedObjectsToken), not the end-result. |
| 8 | CIM_ComputerSystem.CIM_RunningOS{{Name=/CentOS/}}\[0\].Name | Retrieves the Name [property](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLComponentTokens__PropertiesToken) for the first CIM_OperatingSystem instance of each CIM_ComputerSystem instance, [where](https://servicenow-prod.fluidtopics.net/GXvTH_Iwclc3iqPIkbNwXA#r_CimIQLOperationTokens__EnumerateObjectsToken) each CIM_OperatingSystem instance has a Name property containing 'CentOS'. |
[Table 5. CimIQL Tutorial]

{#r_CimIQLTutorial__table_e4t_35d_lp}

## CimIQL results {#ariaid-title6}

CIM Probe results are passed to the probe sensor as an XML document embedded within the
\<output\> element.
The following is a commented example of a CimQuery batch result.

    <!-- document root -->
     <cimqueryset>
     <!-- A single query and query result. Multiple <cimquery> tags may be provided. -->
     <cimquery>
       <!-- The original query, enclosed by CDATA. -->
       <query><!CDATA[[>CIM_ComputerSystem[0].PrimaryOwnerContact<! ]]></query>
       <!-- The resulting data is enclosed within a single <result> tag. -->
       <result>
         <!-- A single class instance result. Multiple <instance> tags may be provided.
              Special tags are prefixed with an underscore character. -->
         <instance>
           <!-- The instance's CIM classname -->
           <_classname>Linux_ComputerSystem</_classname>
           <!-- A set of this instances identifying keys. Always provided, regardless of property filters.
                Within here, each key is provided as <KeyName>VALUE</KeyName> with the VALUE enclosed as CDATA. -->
           <_key>
             <CreationClassName><![CDATA[Linux_ComputerSystem]]></CreationClassName>
             <Name><![CDATA[runtime]]></Name>
           </_key>
           <!-- Each property that matches the query's property filter will be provided here, in the same format as keys;
                As <PropertyName>VALUE<PropertyName> where VALUE is enclosed as CDATA -->
           <PrimaryOwnerContact><![CDATA[root@runtime]]></PrimaryOwnerContact>
         </instance>
       </result>
     </cimquery>
     </cimqueryset>