Open topic with navigation

Data Source Step

A Data Source Step brings data into the query object from the Logger database or an existing query object. A query can have multiple Data Source Steps.

A data source step has the following properties:

Data Source Step Properties
Property	Description
New Source/ Existing QO	Choose whether to use the New Source or existing Query Object.
Connection	Select the connection: MySQL Query Logger Search Query Investigate Query (if available)
SQL	Create an SQL statement with the SQL Designer. Only visible if the Logger database is the data source. The SQL Designer enables you to design SQL statements by dragging and dropping tables (on the Design tab) or by typing the complete SQL (Edit tab). When using the Query Editor, be sure to use the appropriate SQL syntax for your data type. For example, to call a string data type, you must enclose the string with single quotes, as in the query below. `select arc_deviceVendor from events where lower(arc_deviceVendor) = 'arcsight'`
Logger Search Query	Create a Filter or Saved Search Query. Logger Search Query enables you to design a query by clicking any Filter (Shared or System Filter) or Saved Search previously stored in Logger.
Select Fieldset	Select All Fields or choose the specific fields by clicking the drop down.
Parameters	Parameter sub-menu allows to set a start and end time depending on the search time type (based on event time or receipt time).
Sorted	If selected, the data is sorted.
Field Properties	The Field Properties sub-menu (when enabled) allows you to configure the properties of the selected field. See the Field Properties Sub-menu for a description of these properties.

Field Properties Sub-menu

Property	Values	Comments
Data Type	CHAR, NUMBER, DATE, BINARY	Select the data type of the incoming data.
Data Format	Format String	Specify the format of the incoming data. This is useful only if the Date or IP Address type data are incoming in CHAR fields, but need to be converted to Date and Number types for further use.
Database Time Zone	Select Time zone from the list	Specify the time zone in which the incoming date data is stored. This is useful only if date time data needs to be converted to other time zone data based on reporting requirement. For example when incoming GMT data should be converted to another time zone in the report, specify that the incoming data is GMT. The output format is generally specified in the Format Step or in user preferences.
Length/Precision	Enter	Enter the length of field for Char data types, and the precision or length of field for the Number data type.
Scale	Enter	Enter the Scale or number of digits after the decimal point.
Locale	Select from menu	Select the language/ country in which the incoming date data is stored.
Sort Priority	Number 0-N	If the data is sorted on multiple fields, then specify the sort priority number of this field. Primary sort field should be the lowest number.
Sort Criteria	Ascending/ Descending	Specify sort as either ascending or descending order.
Qualified Name	Enter	This name helps by providing a field name for SQL clauses such as WHERE and ORDER BY. It can also be used to resolve field name ambiguity when the same field comes from different tables or expressions.