1. IDIH Log Viewer
  2. Working in Log Viewer
  3. Log Viewer Functionality
  4. Creating or Modifying a Query for Filtering

2.7.1 Creating or Modifying a Query for Filtering

To create or modify a query for use in filtering log records, click Filter. The Query Dialog window opens.

Figure 2-4 Log Viewer Query Dialog


img/log_viewer_query.png

Click Add to create fields for a new query. The query can be deleted by clicking Delete.

When adding a condition, the corresponding label is added into the Expression field. It is added to the end of the expression with the selected Operator (AND or OR). Similarly, when the condition is removed from the query, the corresponding label is automatically removed from the expression and the expression is adjusted. When Use Bracket is selected, then the whole expression is closed in brackets before adding the new condition.

The query is validated before it is saved or executed. Several things are verified:

  • Name is filled (verified for Save operation only, for Query Execution operation the name can be empty)
  • All conditions have correct operator and correct value (empty value not allowed and must correspond to field type)
  • Expression is well formed Boolean expression

Whenever any error occurs, the user is notified either in the Message Panel at the top of the Dialog box or next to the GUI element which caused the error (a condition or expression box).

Note:

For filtering on source and destination node fields, provide either the IP address or select the node name from the list. Selecting the node name means filtering on the list of IP addresses assigned to the selected node. If the same IP Address is being reused across the nodes, filtered data would display other nodes as well.
  1. All fields (all fields are added into Displayed Fields)
  2. Common (all common fields from all dictionaries are selected; if there is just one dictionary then all fields are selected)
  3. Custom fields (the user can select fields of his/her choice)

The Displayed Fields are selected separately per dictionary. If there is more than one dictionary, then fields in the query result are merged together based on the field name. All fields with the same name are displayed in the same column.

Click Save to save a query for later use. The query appears in the Query List panel.

Click Save As to open a prompt asking for a new name. Confirms the name. A new query is created and saved for later use. The query appears in the Query List panel.

Now the query is ready for execution. Execute the query by clicking Apply.