The Wazi Deploy evidence command

To index evidence files in a folder and query them, run the wazideploy-evidence command.

Before you run the command, make sure that at least one evidence file results from at least one deployment with Wazi Deploy and the Ansible® or Python building blocks. You must have access to at least one evidence file.

The command contains one positional attribute that you use to specify whether you want to index the folder that contains the evidence files, query the folder, or index and query the folder in the same run.

To index the folder that contains the evidence files, enter the following command:
```
wazideploy-evidence i
```
Note: In Wazi Deploy 3.0.4, you cannot use an index folder that was created with a previous version because the internal indexing process has changed.

By default, the command indexes the data subfolder of the current folder. If the evidence files are not there, then specify a --dataFolder argument when you run the command.
All the YAML files (with a .yaml or .yml extension) of the data subfolder are recursively indexed.

If you index a folder that has been modified since the last indexing, the indexing is incremental. So, it scans only what is new.

The index is stored by default in the index subfolder. All the following examples assume that the command uses the default subfolder (named index) for the indexes. If your indexes were built to another folder, specify this folder in an --indexFolder argument when you run the examples.
To query the indexed folder, enter the following command:
```
wazideploy-evidence r
```
To index and query the indexed folder in the same run, enter the following command:
```
wazideploy-evidence ir
```

Note: Use examples of the wazideploy-evidence command are provided in Getting started with the analysis of the deployment results.

The following code shows the syntax of the command.

usage: wazideploy-evidence [-h] [-v] [-df dataFolder] [-if indexFolder] [-q query] [-o output] [command ...]

Index or query an evidence database

positional arguments:
  command               evidence database command (i: index, r: request, ir: index and request)

options:
  -h, --help            show this help message and exit
  -v, --version         show version information and exit
  -df dataFolder, --dataFolder dataFolder
                        folder containing the evidence data to index (defaults to 'data')
  -if indexFolder, --indexFolder indexFolder
                        folder containing the index (defaults to 'index')
  -q query, --query query
                        file containing the search query to execute (defaults to 'query.yml')
  -o output, --output output
                        output file where the query reply will be written (defaults to 'reply.yml')

Note: All the files that are used as input to the Wazi Deploy deployment evidence command must be UTF-8 encoded.

The following table describes the options of the wazideploy-evidence command. Each option has a long name and a short name, which are equivalent.

Table 1. Arguments of the command line
Option long name	Option short name	Description	Required
`--help`	`-h`	The command line help.	No
`--version`	`-v`	The Wazi Deploy version.	No
`--dataFolder`	`-df`	The folder that contains the YAML files to index. It defaults to `data`. Note: You can change the default value in The evidence configuration file.	No
`--indexFolder`	`-if`	The folder that contains the index. It defaults to `index`. Note: You can change the default value in The evidence configuration file.	No
`--query`	`-q`	The file that contains the search query to run. It defaults to `query.yml`. For more information about queries, see The query file. Note: You can change the default value in The evidence configuration file. If you enter a dash (`-`) as its value, you must enter the query content directly on the command line, and not in a file. For an easy use of the deployment analysis, predefined queries are provided in the product. For more information, see The predefined queries in the product.	No
`--output`	`-o`	The output file where the query reply is written to. It defaults to `reply.yml`. Note: You can change the default value in The evidence configuration file. If you enter a dash (`-`) as its value, the output is displayed in your terminal and not in a file.	No

Writing the command in file mode or direct mode

You can write the query content either in a query file (file mode) or directly on your terminal (direct mode).

Note: For information on how to write the content of a query, see The select and output clauses of a query.

Using the file mode:
In this mode, you write your query in a YAML file, which you pass to the command. You can do so in various ways.
In the following examples, the query name is yourquery.yml.
- If the query file does not have parameters, you can apply any of the following methods:
  - Use the -q option like in the following example:
```
wazideploy-evidence -q yourquery.yml r
```
    Note: If your query file is named query.yml, the -q argument is optional in this command line because query.yml is the default name of a query. If you do not specify any query name, the wazideploy-evidence command looks for such a file.
    Moreover, if the extension of the query file is .yml, .yaml, or .j2, you can omit the extension in the command line because these are the default extensions for the query files.
  - Use the parameter notation, like in the following example:
```
wazideploy-evidence r query=yourquery.yml
```
  - Use the YAML format directly in the command line, like in the following example:
```
wazideploy-evidence r "{query: yourquery.yml}"
```
- If the query file has parameters, you can apply any of the following methods. In the following examples, the query finds the artifacts that have a CICSLOAD type.
  - Use the -q option, like in the following example:
```
wazideploy-evidence -q yourquery.yml r type=CICSLOAD
```
  - Use the parameter notation, like in the following example:
```
wazideploy-evidence r query=yourquery.yml type=CICSLOAD
```
  - Use the YAML format directly in the command line, like in the following example:
```
wazideploy-evidence r "{query: yourquery.yml, type: CICSLOAD}"
```
Using the direct mode:
In this mode, you enter your query directly on the command line, without any intermediate file. The following commands are given as examples only.
The following command selects all the records of the evidence file.
```
wazideploy-evidence r "{select: all}"
```
The following command selects the records with a name field that starts with LG. It displays these names in the result.
```
wazideploy-evidence r "{select: {name: LG*}, output: {fields: {name: true}}}"
```
The following command selects the records with a name field that starts or ends with A. It displays these names in the result.
```
wazideploy-evidence r "{select: {or: [name: A*, name: '*A']}, output: {fields: {name: true}}}"
```