Using The Materialize View Clause; Using The Like Clause - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI GUIDE Manual

Using the
Materialize View
Clause
Using the Like
Clause
The
materialize view
view and run subsequent queries against the view. You can also specify the period
of time that the
materialized view
The syntax for the
materialized view
materialize view <time> NameOfView as select <statement>
Where:
specifies the time you wish the
•
<time>
• specifies a valid select statement.
<statement>
For example, if you wish to create a
more than 1,000,000 source bytes, enter the following:
materialize view LargeSourceBytesFlows as select * from flows
where sourceBytes >1000000
To select from this view, enter the select statement as you would a valid table:
select * from LargeSourceBytesFlows
You can also use an aggregation statement on a materialized view:
select sourceIP, sum(sourceBytes) from LargeSourceBytesFlows
group by sourceIP
Note: You cannot create a
created materialized view.
If you wish to create a
ambiguous column names, you can define aliases for all computed columns. For
example:
materialize view MyView as select sourceIP, sum(sourceBytes) as
srcBytesSum from flows group by sourceIP
Then you can refer to the alias in a subsequent query against
select * from MyView orderBy srcBytesSum
You can search text fields using the standard
two wild card options supported by the AQL Flow and Query CLI including:
. The percentage (
_ %
wild card option only matches one character.
_
AQL Event and Flow Query CLI Guide
clause allows you to produce query results as a static
is accessible.
includes:
materialized view
materialized view
materialized view
) wild card option matches zero or more characters while the

Using the Materialize View Clause

materialized view
containing flows with
statement based on a previously
to select from a record set with
MyView
clause. You can also use the
like
13
to be accessible.
:
and
%