Topic
  • 2 replies
  • Latest Post - ‏2015-10-05T13:16:46Z by therealbre
therealbre
therealbre
6 Posts

Pinned topic Error while filtering out NULL values

‏2015-10-02T17:18:06Z | 7.2.5 aql is not null rest

Hello,

I am on very 7.2.5 and am getting errors ('The query_expression contains invalid AQL syntax.') while attempting to filter usernames with "IS NOT NULL". I simplified my query down to the simplest possible to disqualify other syntax errors as being an issue. I have tried many variations but cannot seem to get anything to work:

...where username IS NOT NULL...

...where NOT(username IS NULL)...

...where username != '\0'...

...where NOT(username = '\0')...

...where username != ''...

...where NOT(username = '')...

 

The only query that I could get the server to accept was an undocumented variant, but it was not producing predictable results:

...where username NOT NULL...

Any suggestions would be helpful.

Thanks!

  • Taylor.Osmun (IBM)
    Taylor.Osmun (IBM)
    55 Posts
    ACCEPTED ANSWER

    Re: Error while filtering out NULL values

    ‏2015-10-02T17:51:15Z  

    Hi therealbre,

     

    I've tested this on a 7.2.5 system and it looks to be working to me:

       curl -k -X POST -H SEC:<my_token> https://localhost/api/ariel/searches --data-urlencode "query_expression=SELECT COUNT(*) FROM events WHERE username IS NOT NULL"

    Could you provide any more details? Perhaps your query_expression string is not being passed how you are expecting. Also try issuing this through https://${ip}/api_doc to see if you have the same results.

     

    Taylor Osmun
    Software Engineer
    IBM Security Systems

  • Taylor.Osmun (IBM)
    Taylor.Osmun (IBM)
    55 Posts

    Re: Error while filtering out NULL values

    ‏2015-10-02T17:51:15Z  

    Hi therealbre,

     

    I've tested this on a 7.2.5 system and it looks to be working to me:

       curl -k -X POST -H SEC:<my_token> https://localhost/api/ariel/searches --data-urlencode "query_expression=SELECT COUNT(*) FROM events WHERE username IS NOT NULL"

    Could you provide any more details? Perhaps your query_expression string is not being passed how you are expecting. Also try issuing this through https://${ip}/api_doc to see if you have the same results.

     

    Taylor Osmun
    Software Engineer
    IBM Security Systems

  • therealbre
    therealbre
    6 Posts

    Re: Error while filtering out NULL values

    ‏2015-10-05T13:16:46Z  

    It seems that our event collector had a hiccup because all is fine today when I run the queries.

    Thanks.