Using A Select Statement - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI GUIDE Manual

Using a Select
Statement
For example:
If you wish to enter a command in interactive mode:
/opt/qradar/bin/arielClient -start 2007/08/11-01:15:00 -end
2007/08/11-01:17:00 -exectime 60
/opt/qradar/bin/arielClient
/opt/qradar/bin/arielClient -start 2007/08/11-01:15:00 -end
2007/08/11-01:17:00
If you wish to enter a command in non-interactive mode:
/opt/qradar/bin/arielClient -start 2007/08/11-01:15:00 -end
2007/08/11-01:17:00 -exectime 60 -execute "select * from flows
where sourceIP = '231.12.37.17' and protocol != 'TCP.tcp_ip'"
You can use a select statement that includes one or more fields of a flow or event.
You can also use an asterisk (*) to denote all columns. All field names are case
sensitive, however, the terms
supported fields include:
Table 1-2 Supported Fields
Table Supported Statement
Flow application
applicationId
destinationASN
destinationBytes
destinationByteRatio
destinationDSCP
destinationFlags
destinationIP
destinationIfIndex
destinationNetwork
destinationPackets
destinationPacketRatio
destinationPayload
destinationPort
destinationPrecedence
destinationTOS
firstPacketTime
flowDirection
flowSource
flowType
AQL Event and Flow Query CLI Guide
-f csv
and
select from

Using a Select Statement

are not case sensitive. The
7