Error with custom dataset after upgrade

Forum|Forum|11 years ago
December 9, 2014
2 replies
3465 views

Hi, after upgrading FAZ to 5.2.0 we have a problem with an customized dataset. When running a test query we get an error.

This is the query:

SELECT srcip, msg, service, dstip, count(*) as totalnum

FROM $log

WHERE $filter AND srcip IS NOT LIKE '10%' AND (subtype='violation' or action='deny')

GROUP BY srcip, msg, dstip, service

ORDER BY totalnum DESC

Log Type is set to "traffic"

The error we get: ERROR: syntax error at or near "LIKE"

We want to report all blocked outgoing traffic from inside. The filter on "LIKE '10%' " is essential for the report.

Does anybody how to solve this in 5.2.0?

Regards, Olav

Best answer by hzhao_FTNT

Hi Olav,

In 5.2.0, ip has to be convert from inet to string by ipstr(). Your query will be:

SELECT ipstr(srcip) as srcip, msg, service, ipstr(dstip) as dstip, count(*) as totalnum FROM $log WHERE $filter AND ipstr(srcip) NOT LIKE '10%' AND (subtype='violation' or action='deny') GROUP BY srcip, msg, dstip, service ORDER BY totalnum DESC

Regards,

hz

hzhao_FTNTAnswer

Staff

Hi Olav,

In 5.2.0, ip has to be convert from inet to string by ipstr(). Your query will be:

SELECT ipstr(srcip) as srcip, msg, service, ipstr(dstip) as dstip, count(*) as totalnum FROM $log WHERE $filter AND ipstr(srcip) NOT LIKE '10%' AND (subtype='violation' or action='deny') GROUP BY srcip, msg, dstip, service ORDER BY totalnum DESC

Regards,

hz

OlavAuthor

New Member

Hi hz,

thank you for your fast answer. The problem was solved!

Greetz,

Olav

Sign up

Login with SSO

Login to the community

Login with SSO