Search block has been added to create queries by selecting the predefined directives, filters, functions etc. This query builder is an intelligent query processing feature which helps to form queries for new users without prior knowledge of the DQL. The DNIF Query GUI interface lets you search through the data gathered and collated by DNIF. This section introduces you to the various elements and query directives you can use to work with this interface.
How to add a Search Block?
- Hover on the Workbooks icon on the left navigation bar, it will display the folder wise view of existing workbooks in the cluster.
- Click the plus icon at the top right corner , the following Search GUI screen will be displayed.
- Click search icon on the left navigation bar, the following screen will be displayed.
The Search Block is the default block, it will be automatically displayed every time you try to create or add a new workbook.
- You can now select streams while building a query using the search block. Select the stream, filters, and set the duration to fetch details
- Select/Enter the required fields to build your query and click Run, a progress bar will be displayed showing that the query is being processed.
- Once the query is successfully processed, the results will be displayed as below.
- Click Information icon, to view log details. You can view the log details in JSON and TABLE format.
- Click Copy icon, to copy the details to clipboard.
For more details on details on Workbooks, refer Create a Workbook
How to use the search block?
Search is the query builder that will assist you in forming queries even if you don't have any knowledge of DQL
Follow the steps below to build a query using search block.
- On adding a search block, the following screen will be displayed.
- On the above screen, the duration last 5 minutes an $Stream=FIREWALL and LIMIT 100 is set by default, this is a simple query that would retrieve 100 records of the FIREWALL Stream in the last 5 minutes as in the screen below.
You can customize the query as per your requirement by changing the duration and adding filters.