How to ask questions of the data

Use the Query Builder to define and modify questions about the collected data.

There is a distinction between queries and reports:

A query describes a set of information to be obtained from the collected data; for example, find all clients updating a specific database during weekend hours or what unauthorized users have attempted to access sensitive data (Social Security numbers or credit card number).
A report describes how the data returned by a query is presented.

There is a separate Query Builder for each domain, and it is opened from the Query Finder for that domain (see Open the Query Finder section). Click Reports > Report Configuration Tools > Query Builder.

The query builder contains three panes:

The Entity List pane identifies all entities and attributes that are contained in the domain. Entities are represented as folders, and attributes are the items within. Click an entity folder to display its attributes, or click again to hide them. For a description of all entities and attributes, see Entities and Attributes in the Domains, Entities, and Attributes help topic.
The Query Field pane lists all fields to be accessed, what is to be displayed for that field (its value, a count, minimum, maximum, or average), and the sort order. For more information about using this pane, see the Query Fields Overview.
The Query Conditions pane specifies any conditions for selecting the fields that are listed (for example, “where VERB = UPDATE”). For more information about using this pane, see the Query Conditions Overview in the Queries help topic.

For complete information, see the Queries help topic.

Open the Query Finder

There is a separate Query Builder for each reporting domain, so it is important to open the correct Query Builder. Otherwise, the information you want will not be displayed. All domains are described in the Domains topic of the Domains, Entities, and Attributes Appendix.

After determining which domain to use, Click Reports > Report Configuration Tools > Query Builder.

Search for a Query

To locate and view a query definition in the Query Builder, there are several options:

Use the Query Finder - see Use the Query Finder.
From a report that is based on the query, click Edit this Report's Query in the toolbar of the report.

Use the Query finder

Open the Query Finder for the appropriate domain (see Open the Query Finder).
Optional. If you know the Main Entity for the query, select it from the list.
Click Search.

If there is only one query that is defined for the selected Main Entity, that query opens immediately in the query definition panel.

If there are multiple queries that are defined for the selected Main Entity, or if no Main Entity was selected, a list of queries display in the Query List panel.

If a Main Entity was selected for which no queries have been defined, you will be informed.
Do one of the following:
To open the Query Builder panel for one of the listed queries, click on it. To define a new query, click New.

Create a Query

Open the Query Finder for the appropriate domain (see Open the Query Finder).
Click New to open the New Query – Overall Details panel.
Type a unique query name in the Query Name box. Do not include apostrophe characters in the query name.
Select the main entity for the query from the Main Entity list. The main entity controls the level of detail that is available for the query, and that it cannot be changed. Basically, each row of data that is returned by the query represents a unique instance of the main entity, and a count of occurrences for that instance.
Click Next. The new query opens in the Query Builder panel. To complete the definition, see next section on Query Fields.

Query Fields Overview

The Query Fields pane basically lists the columns of data to be returned by the query.

There are two ways to add a field to the Query Fields pane:

Pop-Up Menu Method:

Click the field to be added.
Select Add Field from the pop-up menu.

Drag-and-Drop Method:

Click the icon of the field (not on the field name).
Drag the icon to the Query Fields list and release it.

Regardless of the method that is used, the field is added to the end of the list.

Move or Remove Fields in the Query Fields Pane

To move a field in the Query Fields pane:

Mark the checkbox for the field.
Use the following buttons to move the field to the desired location:

Click Up to move the field up one row.

Click Down to move the field down one row.

Modify a Query

Open the Query Finder for the appropriate domain (see Open the Query Finder).
Use the Query Finder to open the query to be modified.
Refer to the Query Builder Overview topic to modify any component of the query definition.

Create a Report

Once a query has been defined, there are several options for adding a tabular report that is based on that query to an existing menu layout, quickly. These options apply only for tabular reports.

Open the Query Finder for the appropriate domain (see Open the Query Finder).
Use the Query Finder to open the query to use for the report.
Do one of the following:

To create a report, click Create a Report. To redo an existing tabular report, click Regenerate.

To add a tabular report to the My Custom Reports tab, click Add to My Custom Reports in the panel. (If no tabular report has been generated yet for the query, you need to click the Create a Report first.)

In order to see meaningful data in the tabular report, click in order to access the run-time parameters (change the time from and now).