Saved Queries (Devices)
  • 11 May 2022
  • 8 Minutes to read
  • Dark
    Light
  • PDF

Saved Queries (Devices)

  • Dark
    Light
  • PDF

Once you create a new query, or update an existing one, you can save the query and add it to the Saved Queries list for future and advanced use. Saved queries are also used in Enforcement Sets, Dashboard Charts and Reports.

QuerySAveEG.png

Saving a New Query

The Devices page displays the query name above the search bar along with the query status. The query status indicates whether this is a new query that is unsaved, or a saved query that has been edited.
To save a new unsaved query:

  1. Click Save As next to the query name; the Save as a New Query dialog opens.

SaveasNewQuery.png

  1. Set the Query name

  2. Set the Query description (optional)

  3. Tag - Choose a tag from the drop down list of tags available in the system, or start typing to add a new tag. When you add a new tag, click create new to add the tag to the system. Use Clear All to remove a tag you selected. Tags help organize your queries. You can add a tag to a query when you create the query, as well as from the Saved Queries page.

  4. Private Query – Select Private Query if you want the query to be available only to you. A saved query can have private or public access. Private saved queries are only visible for the current user. Public saved queries can be viewed by all users and can be accessed everywhere in the system (Dashboards, Enforcement Center, Reports, Query Wizard).

  5. Choose Save

Note:
The permissions: Create saved query, Edit saved queries, Run saved queries and Delete saved query - All apply on public saved queries only. Private saved queries can always be created, edited, run and deleted.
Note:

If you have written a query in AQL using terms or expressions not supported in the Query Wizard, when you save the query the system informs you that the system will save the query as an AQL expression.

When you save a query, you save the following:

  • Query filter – the collected devices together with their details according to the filter set.
  • Query view – The columns that are displayed when you save the query are saved as part of the query and used to display the same “view” of selected fields in the table every time you use this query. Set the columns in Edit Columns.
NOTE
The “view” is saved as part of the saved query. It doesn’t impact the filtered devices data - only the data that is visible in the query results table.

Running a Saved Query

Once a query is saved you can run it from the Saved Queries page, from the Saved Query drawer or from the Saved Queries list in the Query Search Bar.

Saved Queries List in the Query Search Bar

In the Devices page, click the Query search bar. The drop-down list displays a list of saved queries and history of the queries run in Axonius.
To run a saved query, use the vertical scroll to select the saved query you want. Then click it to run the query.

Saved Searches.png

Working with the Saved Queries Page

Use the Queries page to see a centralized summary of information about the all the saved queries for the devices. You can manage all the queries, and see who updated the query, when it was last used and more.
To open the Saved Queries page, on the Devices page, click Saved Queries on the top right corner above the query results table.

SavedQueries.png

The Saved Queries page opens.

SavedQuereisPAgeN.png

The total number of saved queries is displayed on the top left side of the table:

TotalNoOfSavedQueries.png

A link to Query History is displayed at the top of the page. Click Query History to see information about queries run on the system.

The following information is displayed
.

  • Name - The name of the query. For saved queries, the name that it was saved under. For queries that were not saved, the query name is displayed as “Unsaved query”.

  • Tags - The tags associated with the saved query, if these exist.

  • Access - The access of the saved query.

    • Private - Only the user can view this saved query.
    • Public - All users can view this saved query. It can be used in all Dashboard, Enforcement Center, Reports and Query Wizard.
  • Used In - an icon shows the area of the application in which the Query is used. Mouse over to see more details. This is only available for Administrators.
    Querywithmouseover.png

  • Last Used – the last time the query was run by a user manually.

  • Last Updated - The date and time the saved query was updated.

  • Updated By - The user who made the last update to the query.

    • The user name is displayed with a prefix:
      • Internal - A user who was defined internally in Axonius by one of the system admins.
      • SAML or LDAP - A user who logged in using the LDAP or SAML based login options.
    • If the user no longer exists in the system, the displayed user name is displayed with a “(deleted)” suffix.
    • Hover over the field to display the user's first and last name in addition to the user name, if this exists.
    • For predefined saved queries, that were preconfigured by Axonius, the Updated by value is Predefined.

Search and Filter Saved Queries

You can filter the queries as follows:
QueryFilter.png

  • Query Name - Select one or more query names; the system returns all relevant queries.

  • Tags - Select one or more tags from a list of all the tags associated with the saved queries to filter the display by tags. All saved queries tagged with at least one of the selected tags are displayed. Click Clear All to clear all selections.

  • Access - Select an access type to filter the display by access type. All queries with the selected Access Type are displayed. Click Clear All to clear all selections.

  • Last run from date - Last run to date - Click the date range picker to filter the date queries were run by.

    • Select two dates to set the date range for which queries will be displayed.
    • To filter queries only for a specific date, select the same date twice.
    • Click Select Time in the date range picker to include specific times in the date range.
    • Click OK to set the date range filter

Click Reset to clear the search and filters.


When you click on a query the Saved Query drawer opens.
You can select Run Query to run the query on the devices page.

Updating an Existing Saved Query

After you open a saved query, on the Devices page, you can do the following:

  • Rename a saved query with a single click.
  • Save - Update the saved query you are working on.
  • Save as - Save the query results as a new saved query.
  • Discard Changes - Undo any changes made on the saved query you are working on and reload the saved query.
  • Reset - Reset the page to its default column view and with no filtering, resulted in all devices/users being displayed.
  • Copy Query Link - Click the copy Query Link icon CopyLinkonmain bar.png to copy the link to the query and then share it with others.

QuerySAveEG.png

Saved Query Actions

Deleting Queries

To delete queries

  1. On the Saved Queries page, select one or more queries. When at least one query is selected, the Actions button is displayed above the Saved Queries table.

QueryActionsNe.png

  1. Select Delete to delete one or more query.

Or delete queries from the Saved Queries drawer.

Tagging One or More Queries

You can add tags to one or more queries. You can't tag predefined queries, only queries created by users.

  1. On the Saved Queries page, select one or more queries. When at least one device is selected, the Actions button is displayed above the Saved Queries table.

  2. Select Tag to tag one or more query; the Tag Saved Queries dialog opens.
    TagSavedQuereis.png

  3. Choose a tag from the drop down list of tags available in the system, or start typing to add a new tag. When you add a new tag, click Create New to add the tag to the system.

CreateNewTag.png

  1. Click Save.

Viewing and Editing Query Details

Use Saved Query drawer to view query details, edit them, and perform actions on the query.

On the Saved Queries page, click a saved query record to view its details; the Saved Query drawer opens. When you open a query saved in AQL format it is displayed in the Query Wizard in AQL format.
You can view and edit the following saved query details:

Click EditQueryicon.png to edit the following query details

  • Name
  • Description (optional, limited to 300 characters)
  • Tags
  • Always keep Cached
  • View the following saved query details:
    • Query Wizard expressions
    • Last updated
    • Updated by

In addition, you can perform the following actions:

  • Click RunQueryButton.png Run Query to run the query and display the results in the Devices / Users page.

  • Click CopyQueryLink.png Copy Query Link to copy the link to the query and share it with others.

  • Click CopyEnforcementLink.png New Enforcement to create a new enforcement set using the saved query as a trigger. The Enforcement Set Configuration page opens. You can create a new enforcement set for the selected query that is already automatically configured as part of the enforcement set trigger. For more details, see Creating new Enforcement Sets.
    You can add a new enforcement to a single query one at a time.

  • Click Set Public.png Set access to public on private saved queries to set the access to public. Changing the access of a saved query to public will make it publicly available to all users and cannot be reset to private.

  • Keep saved query always cached - The Keep always cached checkbox lets you keep a saved query always cached.

    • If enabled, the saved query will always be cached. The saved query will be executed and cached each TTL interval defined in Cache Settings.
    • If disabled, the saved query will not be always cached.
    • This checkbox is only visible when Caching is enabled in the system.
  • Click DeleteQuery.png Delete to delete the saved query.

SavedQueriesUPd.png



First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.