Error with custom dataset after upgrade

[Olav]

Hi, after upgrading FAZ to 5.2.0 we have a problem with an customized dataset. When running a test query we get an error.

This is the query:

SELECT srcip, msg, service, dstip, count(*) as totalnum

FROM $log

WHERE $filter AND srcip IS NOT LIKE '10%' AND (subtype='violation' or action='deny')

GROUP BY srcip, msg, dstip, service

ORDER BY totalnum DESC

Log Type is set to "traffic"

The error we get: ERROR: syntax error at or near "LIKE"

We want to report all blocked outgoing traffic from inside. The filter on "LIKE '10%' " is essential for the report.

Does anybody how to solve this in 5.2.0?

Regards, Olav

[hzhao_FTNT · Accepted solution]

Hi Olav,

In 5.2.0, ip has to be convert from inet to string by ipstr(). Your query will be:

SELECT ipstr(srcip) as srcip, msg, service, ipstr(dstip) as dstip, count(*) as totalnum FROM $log WHERE $filter AND ipstr(srcip) NOT LIKE '10%' AND (subtype='violation' or action='deny') GROUP BY srcip, msg, dstip, service ORDER BY totalnum DESC

Regards,

hz

[Olav]

Hi hz,

thank you for your fast answer. The problem was solved!

Greetz,

Olav