create_ad_hoc_query

Performing an Ad Hoc Query

• Saving an Ad Hoc Query saves only the criteria specified for the query. The data an Ad Hoc Query returns does not save. To save the data, export the query results or create a report using a grid table.

To perform an Ad Hoc query:

• Logs/Reports > New Ad Hoc Query

1. Navigate to the Ad Hoc Query screen.

Step 1: Specify the Origin of the Information:

1. From the New Ad Hoc Query screen, select the origin for the information query:

• Select Control Manager: Specifies that information originates from the Control Manager server to which the user is currently logged on.

Specifying this option disables the Product Tree, because the information only comes from the Control Manager server to which the user is logged on.

• Select Product Tree: Specifies that information originates from the managed products the Control Manager server manages. This can include managed products from child Control Manager servers.

After specifying this option, the user must then select the managed products or directory from which the information originates.

• Selecting the managed product or directory on this screen affects the available data views on the following screen.
  
  For example, by selecting OfficeScan in the product directory, only data views associated with OfficeScan display in the Available Data Views list.

2. Click Next. The Step 2: Data View screen appears.

Step 2: Specify a Data View for the Query:

1. Select a data view from the Available Data Views list. For more information on data views, see Understanding Data Views.

2. Click Next. The Step 3: Query Criteria screen appears.

Step 3: Specify the Display Sequence:

Specify the display and sequence for the information the query returns:

1. Click Change column display. The Select Display Sequence screen appears.

2. From the Available Fields list, select the data view columns to display when the query returns information. Selected columns highlight.

• Select the columns one at a time or use the Shift or Ctrl keys to select multiple columns.
  
  Selecting and adding one column at a time is one method that allows users to specify the sequence in which the information displays.

3. Click the Add button to include the fields in the Selected Fields list. Selected columns appear in the Selected Fields list.

4. Continue selecting and adding columns until you have all the columns you require.

5. Use the Move Up and Move Down buttons, after selecting a column in the Selected Fields list, to specify the display sequence of the information. The column at the top of the list appears as the left-most column in the returned query.

6. Click Back. The Query Criteria screen appears.

Step 4: Specify the Filtering Criteria:

When querying for summary data (any data view with the word Summary in the title), you must specify items under Required Criteria.

1. Specify the Required Criteria:

• Specify a Summary Time for the data, and for spyware/grayware data views, whether you want COOKIES to appear in your results.

2. Specify the Custom Criteria:

1. Select Custom criteria. The custom criteria options appear.

2. Specify the criteria filtering rules for the data categories from the Match field:

• All of the criteria: This selection acts as a logical AND function. Data appearing in the report must meet all the filtering criteria.

• Any of the criteria: This selection acts as a logical OR function. Data appearing in the report must meet any of the filtering criteria.

3. Specify the filtering criteria for the data. Control Manager supports specifying up to 20 criteria for filtering data.

• If you do not specify any filtering criteria, the Ad Hoc query returns all results for the applicable columns. Trend Micro recommends specifying filtering criteria to simplify data analysis after the information for the query returns.

1. From the left-most drop-down list, select the column to filter.

2. From the middle drop-down list, select the matching condition for the filter.

3. In the right-most field, provide the filter criteria. A list box or text box appears here depending on the column selected to filter.

4. Click the + icon to add another filter criterion for the data view.

Step 5: Save and Complete the Query:

1. Click Save this query to the saved Ad Hoc Queries list under Save Query Settings to save the Ad Hoc query.

2. Specify an Ad Hoc Query name in the Query Name field.

• Control Manager supports sharing saved Ad Hoc Queries with other users. Saved Queries appear on the Logs/Reports > Saved Ad Hoc Queries screen.

3. Click Query. The Results screen appears displaying the results of the query.

For more detailed information about a given item, click the underlined link for the item.

Step 6: Export the query results to CSV or XML:

1. A File Download dialog box appears after clicking one of the following:

• Export to CSV: Exports the query results to CSV format.

• Export to XML: Exports the query results to XML format.

2. Complete one of the following:

• Click Open to view the query results immediately in CSV or XML format.

• Click Save. A Save As dialog box appears. Specify the location to save the file.

3. To save the settings for the query:

1. Click Save query settings. A confirmation dialog box appears.

2. Type a name for the saved query in the Query Name field.

3. Click OK. The saved query appears on the Saved Ad Hoc Queries screen.

See also:

Using Logs

Understanding Log Aggregation

Querying Log Data

Understanding Data Views

Working With Saved and Shared Ad Hoc Queries

Editing Saved Ad Hoc Queries

Working With Shared Ad Hoc Queries

Deleting Logs