edit_saved_queries

Editing Saved Ad Hoc Queries

Control Manager supports modifying saved Ad Hoc queries from the My Queries tab of the Saved Ad Hoc Queries screen. Modifying a saved Ad Hoc query requires the following steps:

To edit a saved Ad Hoc query:

• Logs/Reports > Saved Ad Hoc Queries

1. Navigate to the Saved Ad Hoc Queries screen.

2. Click the name of the saved Ad Hoc query to edit. The Select Product Tree screen appears.

Step 1: Specify the origin of the information:

1. From the New Ad Hoc Query screen, specify the network protection category (managed product or directory) from which the report generates.

• Select Control Manager: Specifies that information originates from the Control Manager server to which the user is currently logged on.

Specifying this option disables the Product Tree, because the information only comes from the Control Manager server to which the user is logged on.

• Select Product Tree: Specifies that information originates from the managed products the Control Manager server manages.

After specifying this option, the user must then select the protection category from which the information originates. The user does this by selecting managed products/directories from Product Directory.

• Selecting the managed product/directory on this screen affects the available data views. For example, by selecting OfficeScan in the product directory only data views associated with desktop protection display in the Data Views list.

2. Click Next. The Select Data View screen appears.

Step 2: Specify a data view for the query:

1. Select a data view from the Available Data Views list. For more information on data views, see Understanding Data Views.

2. Click Next. The Query Criteria screen appears.

Step 3: Specify the display sequence:

Specify the display and sequence for the information the query returns:

1. Click Change column display. The Select Display Sequence screen appears.

2. From the Available Fields list, select the data view columns that display when the query returns information. Selected columns highlight.

• Select the columns one at a time or use the Shift or Ctrl keys to select multiple columns.
  
  Selecting and adding one column at a time is one method that allows users to specify the sequence which the information displays.

3. Click the Add button to include the fields in the Selected Fields list. Selected columns appear in the Selected Fields list.

4. Continue selecting and adding columns until you have all the columns you require.

5. Use the Move Up and Move Down buttons, after selecting a column in the Selected Fields list, to specify the display sequence of the information. The column at the top of the list appears as the left-most column in the returned query.

6. Click Back. The Query Criteria screen appears.

Step 4: Specify the filtering criteria:

When querying for summary data (any data view with the word Summary in the title), you must specify items under Required Criteria.

1. Specify the Required Criteria:

• Specify a Summary Time for the data or whether you want COOKIES to appear in your reports.

2. Specify the Custom Criteria:

1. Select Custom criteria. The custom criteria options appear.

2. Specify the criteria filtering rules for the data categories from the Match field:

• All of the criteria: This selection acts as a logical AND function. Data appearing in the report must meet all the filtering criteria.

• Any of the criteria: This selection acts as a logical OR function. Data appearing in the report must meet any of the filtering criteria.

3. Specify the filtering criteria for the data. Control Manager supports specifying up to 20 criteria for filtering data.

• If you do not specify any filtering criteria, the Ad Hoc query returns all results for the applicable columns. Trend Micro recommends specifying filtering criteria to simplify data analysis after the information for the query returns.

1. From the left-most drop-down list, select the column to filter.

2. From the middle drop-down list, select the matching condition for the filter.

3. In the right-most field, provide the filter criteria. A list box or text box appears here depending on the column selected to filter.

4. Click the + icon to add another filter criterion for the data view.

Step 5: Save and complete the query:

1. Click Save this query to the saved Ad Hoc Queries list under Save Query Settings to save the Ad Hoc query.

2. Specify an Ad Hoc Query name in the Query Name field.

• Control Manager supports sharing saved Ad Hoc Queries with other users. Saved Queries appear on the Logs/Reports > My Reports screen.

3. Click Query. The Results screen appears displaying the results of the query.

Step 6: Export the query results to CSV or XML:

1. A File Download dialog box appears after clicking one of the following:

• Export to CSV: Exports the query results to CSV format.

• Export to XML: Exports the query results to XML format.

2. Complete one of the following:

• Click Open to view the query results immediately in CSV or XML format.

• Click Save. A Save As dialog box appears. Specify the location to save the file.

See also:

Using Logs

Understanding Log Aggregation

Querying Log Data

Understanding Data Views

Performing an Ad Hoc Query

Working With Saved and Shared Ad Hoc Queries

Working With Shared Ad Hoc Queries

Deleting Logs