Method: ExecuteQuery
Description
Executes a complex query for logs that match query parameters.
Input
The input of this method is the argument ExecuteQuery having the following structure.
|
Element |
Type |
Nillable? |
Description |
|---|---|---|---|
|
Query |
LogQueryParametersDataModel |
Yes |
Query |
Output
Results of the log query.
|
Element |
Type |
Nillable? |
Description |
|---|---|---|---|
|
ExecuteQueryResult |
ArrayOfLogDataModel |
Yes |
|
Faults
|
Name |
Content |
Description |
|---|---|---|
|
LogRhythmWebServiceFaultFault |
LogRhythmWebServiceFault |
This is the error message object for all of LogRhythm Web Services. This object provides custom meaningful error messages to the client while retaining security precautions for the system. |
EXAMPLE
public void ExecuteQuery_SingleCommonEvent()
{
LogQueryServiceClient logQueryClient = new LogQueryServiceClient("LogQueryServiceBasicAuth_LogQueryService");
logQueryClient.ClientCredentials.UserName.UserName = username;
logQueryClient.ClientCredentials.UserName.Password = password;
// Build Date Range filter
LogQueryDateRangeValue dateRangeValue = new LogQueryDateRangeValue
{
StartRangeValue = DateTime.Now.AddDays(-1),
EndRangeValue = DateTime.Now
};
LogQueryFilterValueDateRangeDataModel filterValueDateRange = new LogQueryFilterValueDateRangeDataModel
{
Value = new LogQueryDateRangeValue[] { dateRangeValue },
ValueType = LogQueryFilterValueTypeEnum.DateRange
};
LogQueryFilterDataModel filterDateRange = new LogQueryFilterDataModel
{
FilterType = LogQueryFilterTypeEnum.NormalMsgDateRange,
FilterValues = filterValueDateRange,
FilterOperator = LogQueryFilterOperatorEnum.And,
FilterMode = LogQueryFilterModeEnum.FilterIn,
IncludeNullValues = false
};
// Build Common Event filter
LogQueryFilterValueIntegerDataModel filterValueCommonEvent = new LogQueryFilterValueIntegerDataModel
{
Value = new int[] { 19115 },
ValueType = LogQueryFilterValueTypeEnum.Integer
};
LogQueryFilterDataModel filterCommonEvent = new LogQueryFilterDataModel
{
FilterType = LogQueryFilterTypeEnum.CommonEvent,
FilterValues = filterValueCommonEvent,
FilterOperator = LogQueryFilterOperatorEnum.And,
FilterMode = LogQueryFilterModeEnum.FilterIn,
IncludeNullValues = true,
};
// Complete query
LogQueryParametersDataModel logQueryParameters = new LogQueryParametersDataModel()
{
MaxItems = 5000,
includeRawLogs = false,
logSourceIDs = null,
logSourceListIDs = null,
PageSize = 500,
LogManagers = new int[] { 1 },
QueryLogManagers = true,
QueryEventManager = false,
PrimaryFilter = new LogQueryFilterDataModel[2] { filterDateRange, filterCommonEvent }
};
// Execute Query
LogQueryCollection data = logQueryClient.ExecuteQuery(logQueryParameters);
}