Help Center/ SecMaster/ User Guide/ Threat Operations/ Security Analysis/ Query and Analysis Statements - SQL Syntax/ Query Statements
Updated on 2024-11-06 GMT+08:00
View PDF

Query Statements

A query statement is used to specify the filter criteria for log query and return the logs that meet the filter criteria. By setting filter criteria, you can quickly query required logs.

This topic describes query statements and examples.

Syntax

A query statement can be in either of the following formats:

  • If the value is only *, full data is returned without filtering.
  • It consists of one or more query clauses. The clauses are connected by NOT, AND, and OR. () can be used to increase the priority of the query conditions in parentheses.

The basic structure of a query clause is as follows:

Field Name Operator Field Value

Operators lists the operators that can be used.

Operators

Table 1 Operator descriptions

Operator

Description

=

Queries logs in which the value of a field is equal to a certain value.

<>

Queries the logs in which the value of a field is not equal to a certain value.

>

Queries logs in which the value of a field is greater than a specified value.

<

Queries logs in which the value of a field is less than a specified value.

>=

Queries logs in which the value of a field is greater than or equal to a specified value.

<=

Queries logs in which the value of a field is less than or equal to a specified value.

IN

Queries the logs whose field values are within a specified value range.

BETWEEN

Queries the logs whose field values are in the specified range.

LIKE

Searches for logs of a field value in full text.

IS NULL

Queries logs whose field value is NULL.

IS NOT NULL

Query logs whose field value is NOT NULL.

Examples

Table 2 Example query statements

Query Requirement

Query Statement

All logs

*

Logs about successful GET requests (status codes 200 to 299).

request_method = 'GET' AND status BETWEEN 200 AND 299

Logs of GET or POST requests

request_method = 'GET' OR request_method = 'POST'

Logs of non-GET requests

NOT request_method = 'GET'

Logs about successful GET or POST requests

(request_method = 'GET' OR request_method = 'POST') AND status BETWEEN 200 AND 299

Logs of GET or POST request failures

(request_method = 'GET' OR request_method = 'POST') NOT status BETWEEN 200 AND 299

Logs of successful GET requests (status code: 200 to 299) whose request time is greater than or equal to 60 seconds.

request_method = 'GET' AND status BETWEEN 200 AND 299 AND request_time >= 60

Logs whose request time is 60 seconds.

request_time = 60