Accessing a GLOBALVIEW database

Use the QRadar® REST API documentation interface to get the GLOBALVIEW database results for a given saved search name and time range. The type of data contained in the database results corresponds to the type of saved search queried.

1. Find a saved search.
   1. On the navigation menu ( ), click Admin.
   2. In the System Configuration section, click Aggregated Data Management.
   3. Under the Saved Search Name column, record a saved search name from the list.
2. Query the QRadar REST API to find a search ID.
   1. Log in to the QRadar API, https://<Console IP>/api_doc, as an administrator.
   2. Click the most recent version of the QRadar API.
   3. Click the /ariel/searches endpoint.
   4. Click POST.
   5. In the query_expression parameter field, type the following command: select * from GLOBALVIEW('savedsearch','timerange')

      Use one of the following values for the timerange variable:

      NORMAL
      HOURLY
      DAILY

      The following example shows query for Top Log Sources with a time range of the last two days:

      select * from GLOBALVIEW('Top Log Sources','DAILY') last 2 days

   6. Click Try It Out!
   7. Copy the search ID from the response body.
3. Get the search results.
   1. From the /ariel/searches/search{id}/results endpoint, click GET.
   2. In the search_id parameter field, enter the search ID.
   3. Click Try It Out!.
   4. Ensure that the search successfully completes.
   5. Get the database results from the response body.