Understanding Queries |
Understanding QueriesNFR runs queries against the data that is stored on disk by the backends. The query backend accesses the data sets that were produced by its matching backend. NOTE: Because backends are querying data stored on disks, you run the risk that the data will no longer be readily available. Spacemand could have deleted or archived the data based upon your retention criteria. When you request a display of data, queries will match your criteria against the contents of the data.You can access the list data through the GUI. You can customize your query by specifying values or ranges of values to display. This will allow you to view only that information that is pertinent. You can also restrict which rows to display based on a particular range of time. Query MatchingYou can query for records that either:
For a record to match, every query field where you entered a value has to match. That does not necessarily mean those fields will be displayed. For example, you could query on the first column, but only display the second. The data you enter in the query text box must be one of the following:
The following are all valid queries:
When it compares a record to the query you entered, it checks these things:
If you have a list with a source IP address in it, you could match a particular source IP address using any of the following methods:
In backend specific queries, the first two are the same. The last would be the same if you only have one type of IP address in your list. If the list has both source IP addresses and destination IP addresses, it will match either of them. Using Queries to View HistogramsYou can display particular time intervals that have data that matches your query, or you can display a particular time interval which will contain all activity for that period. You can use any range of time in the query. It is not restricted to the histogram interval. With the query feature, you can combine and display several intervals into a single histogram. For example, if your histogram is over a half hour period, but you make a query over a two hour period, it will combine four half-hour histograms into one two hour histogram. You can query a period that is not exactly on an interval boundary. It will round the start time down to the beginning of an interval and round the stop time up to the end of the interval. For example, if you have a half hour histogram, but query from 10:20 to 10:40, it will display the time period from 10:00 to 10:59:59. The query can also optionally "collapse" some of the columns, leaving you with a simpler histogram. When you collapse a column, the query results are as if that column had never been part of the histogram. With the collapse feature, you can vary the view of the data. For example, if you collect a single histogram of multiple columns, you can redisplay it with various columns collapsed to get varying views of the data. |
|