API Programming Guide › CA User Activity Reporting Module API Examples › Query and Report Viewer Calls › Query Specifications

Query Specifications

You can prequalify the results of a getQueryViewer, run getReportViewer, or runQuery call by adding specifications. You can set present detailed information that can be a subset of an existing query, or relevant to particular consumers. For example, you can use specifications to query one server for a certain type of events in the past day only.

You can set the following specifications:

server

Specifies the CA User Activity Reporting Module server queried. The default is localhost, the server named in the getQuery call. You can use this specification to target a different server.

timezone

Defines the time zone in which the query appears. The default is the time zone in which the CA User Activity Reporting Module server is running. You can use this specification to set your results in a different time zone.

federated

Specifies (using true or false) whether the query is applied to the appropriate federated servers. The default value is true, which applies the query across federated servers. This behavior applies the normal CA User Activity Reporting Module rules for querying federation hierarchies.

filterXml

Defines the data filters applied to the query, in XML format. You could use this specification to filter on hostname or other CEG fields.

IncidentFilterXml

Defines the data filters applied to an incident query included in a report, in XML format. You could use this specification to filter on the incident creation time or other CEG fields. This specification applies only to the getReportViewer call.

accessfilterXml

Defines the data filters applied to the query, in XML format. You could use this specification to filter a query or report result according to your role when you use the certificate name and password authentication.

params

Defines the result conditions applied to the query, in XML format.

prompt

Controls (using true or false) whether the additional prompt controls are displayed. The default value is false. This value is only valid if the query type is prompt. The value is ignored if the query is not a prompt.

The following specifications are only used if you have set "prompt=true":

promptvalue

Sets the filter value for a prompt query.

col

Lists the event columns the prompt query searches. You can use multiple col terms to identify more than one target column.

More information:

getQueryViewer

Prompt Queries

runQuery