Help Center/ SecMaster/ User Guide/ Threat Operations/ Query and Analysis Syntax - V2/ Retrieval SQL Syntax Reference/ Overview
Updated on 2024-11-11 GMT+08:00
View PDF
Share

Overview

Basic Syntax

An SQL statement consists of a query statement and an analysis statement, which are separated by a vertical bar (|). Query statements can be used independently, but analysis statements must be used together with query statements.

Query Statement | Analysis Statement
Table 1 Basic syntax

Statement Type

Description

Query Statement

A query statement is used to specify the filter criteria for log query and return the logs that meet the filter criteria. By setting filter criteria, you can quickly query required logs.

Analysis Statement

An analysis statement is used to calculate and collect statistics on query results.

Limitations and Constraints

  • Query statements do not support mathematical operations, such as (age + 100) ≤ 1000.
  • Aggregate functions support only fields and do not support expressions, for example, avg(log(age)).
  • Multi-table association is not supported.
  • Subqueries are not supported.
  • A maximum of 500 records can be returned on the page.
  • A maximum of 10,000 groups can be returned by GROUP BY.