Using The Describe Statement - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI GUIDE Manual

14 U AQL Q
SING THE
Using the Describe
Statement
CLI
UERY
For example:
If you wish to match names such as, Joe, Joanne, Joseph, or any other name
beginning with Jo, enter the following clause:
select * from events where userName like 'jo%'
If you wish to match names beginning with Jo that are three characters long, such
as, Joe or Jon, enter the following clause:
select * from events where userName like 'jo_'
You can enter the wild card option at any point in the command. For example:
select * from flows where sourcePayload like '%xyz'
select * from events where payload like '%xyz%'
select * from events where payload like '_yz'
The statement allows you to view the fields that are available for a
describe
particular table or a materialized view. The syntax includes:
describe tablename|viewname
For example:
describe flows
describe my_materialized_view
The output for the
associated types. The type can be either numeric, text, or composite. A composite
type cannot be used in a
For example:
Query >> describe flows
Available fields:
intervalID (NUMERIC)
flowType (NUMERIC)
firstPacketTime (NUMERIC)
icmpType (COMPOSITE)
...
...
...
sourceFlags (NUMERIC)
destinationFlags (NUMERIC)
sourceTOS (COMPOSITE)
destinationTOS (COMPOSITE)
AQL Event and Flow Query CLI Guide
statement includes all the available fields and the
describe
clause.
where