Creating or Modifying a Query

To create a new query or modify existing query, click the Create New Query or Modify Selected Query. The Query Dialog box opens.

Query Dialog

The query must have at least one dictionary. To add a dictionary, select a dictionary from the Available Dictionaries pulldown list and click the (+) button. To remove a dictionary, click the (-) button.

Once the dictionary has been added to the query, the conditions can be added using the Add button. The query can have no conditions, otherwise the query will match all Transaction Detail Records (TDRs) for a given dictionary. Each dictionary has its own conditions, making it possible to search for TDRs from different dictionaries with different conditions.

When adding a condition, the corresponding label is added into the Expression field. It is added to the end of the expression with the selected Operator (AND or OR). Similarly, when the condition is removed from the query, the corresponding label is automatically removed from the expression and the expression is adjusted. When Use Bracket is selected, then the whole expression is closed in brackets before adding the new condition.

Note: The user can edit the expression to be more complex such as "(A AND B) or C"

The query is validated before it is saved or executed. The following things are verified:

Name is filled (verified for Save operation only, for Query Execution operation the name can be empty)
All conditions have correct operator and correct value (an empty value is not allowed and it must correspond to field type)
Note: The user can also use wild cards in the value field. To see descriptions of these wild cards, hover on the most right-hand "?" in the query dialog after selecting a field.
Expression is well formed Boolean expression

Whenever any error occurs, the user is notified either in the Message Panel at the top of the Dialog box or next to the GUI element which caused the error (a condition or expression box).

Note: For filtering on source and destination node fields, provide either the IP address or select the node name from the list. Selecting the node name means filtering on the list of IP addresses assigned to the selected node. If the same IP Address is being reused across the nodes, filtered data would display other nodes as well.

By default, when a dictionary is added into the query, all displayable fields from that dictionary are selected as Displayed Fields. If desired, change the Display Fields in the Displayed Fields tab. There are 3 modes to choose from:

All fields (all fields are added into Displayed Fields)
Common (all common fields from all dictionaries are selected; if there is just one dictionary then all fields are selected)
Custom fields (the user can select fields of his/her choice)

The Displayed Fields are selected separately per dictionary. If there is more than one dictionary, then fields in the query result are merged together based on the field name. All fields with the same name are displayed in the same column.

Click Save to save a query for later use. The query appears in the Query List panel.

Click Save As to open a prompt asking for a new name. Confirms the name. A new query is created and saved for later use. The query appears in the Query List panel.

Now the query is ready for execution. Execute the query by clicking the Apply button.