Understanding Queries
Home ] Up ] Need for NFR ] Using the GUI ] [ Understanding Queries ] Understanding Backends and Packages ] Understanding Alerts ] Understanding Space Management ]


Understanding Queries

NFR runs queries against the data that is stored on disk by the backends. The query backend accesses the data sets that were produced by its matching backend.

NOTE: Because backends are querying data stored on disks, you run the risk that the data will no longer be readily available. Spacemand could have deleted or archived the data based upon your retention criteria.

When you request a display of data, queries will match your criteria against the contents of the data.You can access the list data through the GUI. You can customize your query by specifying values or ranges of values to display. This will allow you to view only that information that is pertinent.  You can also restrict which rows to display based on a particular range of time.

Query Matching

You can query for records that either:

  • match a particular column
  • match a column of a particular type

For a record to match, every query field where you entered a value has to match. That does not necessarily mean those fields will be displayed. For example, you could query on the first column, but only display the second.

The data you enter in the query text box must be one of the following:

  • a value to match exactly
  • a range of values separated by a dash
  • a list of values or ranges separated by commas

The following are all valid queries:

  • 3
  • 10.0.0.1
  • 6-17
  • 6-17,19,22-28
  • 10.0.0.0-10.0.0.255

When it compares a record to the query you entered, it checks these things:

  • for each column you entered a query for, it matches the query
  • for each primary type, the column of that primary type matches the query
  • for each secondary type, at least one column of that secondary type matches the query

If you have a list with a source IP address in it, you could match a particular source IP address using any of the following methods:

  • enter the address of interest in the column field
  • enter the address of interest as a SRC_IP primary type
  • enter the address of interest as an IP secondary type

In backend specific queries, the first two are the same.   The last would be the same if you only have one type of IP address in your list. If the list has both source IP addresses and destination IP addresses, it will match either of them.

Using Queries to View Histograms

You can display particular time intervals that have data that matches your query, or you can display a particular time interval which will contain all activity for that period.

You can use any range of time in the query. It is not restricted to the histogram interval. With the query feature, you can combine and display several intervals into a single histogram. For example, if your histogram is over a half hour period, but you make a query over a two hour period, it will combine four half-hour histograms into one two hour histogram.

You can query a period that is not exactly on an interval boundary. It will round the start time down to the beginning of an interval and round the stop time up to the end of the interval. For example, if you have a half hour histogram, but query from 10:20 to 10:40, it will display the time period from 10:00 to 10:59:59.

The query can also optionally "collapse" some of the columns, leaving you with a simpler histogram. When you collapse a column, the query results are as if that column had never been part of the histogram.

With the collapse feature, you can vary the view of the data. For example, if you collect a single histogram of multiple columns, you can redisplay it with various columns collapsed to get varying views of the data.


Back ] Home ] Up ] Next ]