How to filter query by time on RestAPI

[Anonymous]

I'm trying to get a listing of sessionid and time for specific sessions where the alias.host matches a specific domain within a set time period.  However when I use the following it doesn't limit the time period and I get all of the sessions returned:

http://<device>:<port>/sdk?msg=query&query=select sessionid time where alias.host="domain.com"&time1="2012-Dec-03 00:00:01"&time2="2012-Dec-04 00:00:01"&size=1000

or

http://<device>:<port>//sdk?msg=query&query=select%20sessionid20where%20alias.host=%22domain.com%22&time1=%222012-Dec-03%2000:00:01%22&time2=%222012-Dec-04%2000:00:01%22&size=1000

What am I missing?

[Anonymous]

Try with time as part of the where clause something like:

http://<device>:<port>/sdk?msg=query&query=select%20sessionid,time%20where%20alias.host%3D%22domain.com%22%20%26%26%20time%3D%222012-Dec-03%2000:00:01%22-%222012-Dec-04%2000:00:01%22&size=1000

Hopefully, I don't have any typos on the url enconding in clear the query should be

select sessionid, time where alias.host='domain.com' && time='2012-Dec-03 00:00:01'-'2012-Dec-04 00:00:01'

Hope that helps!

Rui

[Anonymous]

I've tried it using that time format as well but it looks like it only queries based on one field

If I use this query:

/sdk?msg=query&query='select sessionid,time where time="2012-Dec-03 00:00:01-2012-Dec-04 00:00:01"&&alias.host="domain.com"'&size=1000

Then I get all the sesions within that time period

If I use the query I listed in my first entry I get all sessions for the alias.host.

[Anonymous · Accepted solution]

You need to encode the & as %26 and there should be two of them.

& is the parameter separator for HTTP so if it's not encoded it will actually make the value an additional HTTP parameter instead of a part of the query.

My reply is based on the example above, apologies if you are just trying to make it readable.

Got the issue, I used the wrong quotes on time it's ' instead of "

The following just worked for me:

/sdk?msg=query&query=select%20sessionid,time%20where%20alias.host%3D'google.com'%20%26%26%20time%3D'2012-Dec-03%2000:00:01'-'2012-Dec-04%2000:00:01'&size=1000

[Anonymous]

That worked for me.  Thanks!

[KennyKim]

From my experience, i encode three characters '&', ''', ' ' (Amp, single quotation and space character) in where clause.

%26 = &

%27 = ' (single quotation)

%20 = [space]