Custom properties in AQL queries

You can call a custom property directly in your AQL statements. If the custom property contains spaces you must use double quotation marks to encapsulate the custom property.

You must enable a custom property before you can use it in an AQL statement.

If the custom property is not enabled, you will be able to run your AQL query but you will not get results.

Custom property example

SELECT Bluecoat-cs-host, sourceip, Bluecoat-cs-uri
FROM events
WHERE LOGSOURCEGROUPNAME(devicegrouplist)
ILIKE '%Proxies%' 
AND Bluecoat-cs-host ILIKE '%facebook.com%'
GROUP BY sourceip

Bluecoat-cs-host is the host name from the client's URL that is requested.

Bluecoat-cs-uri is the original URL that is requested.