Query Command

Document created by RSA Information Design and Development on Apr 10, 2019Last modified by RSA Information Design and Development on Jan 31, 2020
Version 5Show Document
  • View in full screen mode

This command is equivalent to the SDK NwQuery function. The parameters are identical, including the format of the queries. The query command is used to select metadata from one or more sessions. The select clause is a comma separated list of meta keys (or select * to retrieve all keys). The where clause is used to restrict or limit the scope of the query.

Assume you have the following query:

select service, ip.src, city.src
   where service=0,

The output might look like this:

You are here
Table of Contents > Query Command