DQL Report for a single indexer, collector or filer.

Dave we need to clarify some things for the request. You could run a report based on data originating from a specific device or residing on a particular indexer for the indices to query. The collector is an instrument of the process and contains no data or better said only data in transit and has nothing to report against.

 

I'll take you query above as example since it is missing the MSU column and the filter will not exist in the SDK manual. That said I think you are trying to identify a filter like a particular device or share to report upon.

 

In the configdb there is a node table  or you can right click the DataInsight servers column header to add the ID column to learn the id of an indexer and the same is true for the MSU table to the monitored shares page on a filer. In the example below I changed the query for my dataset and chose my Profiles share for users whose ID is 12. I removed the sensitive path value as it was not applicable for my dataset.

Run yourself a test with the column values form the SDK and the correct value from the environment and that should work for you.

 

Rod

 

FROM       activity

GET          user.name,

                 user.domain,

                 sum(count) AS access_count,

                 path.device.name,

                 path.absname,

                 path.msu.id,

                 formatdate(timestamp, "YYYY-MM-DD HH:mm")

IF              

                 timestamp >= datetime("2014/01/01 00:00", "YYYY/MM/DD HH:mm")

AND

                 timestamp <= datetime("2015/04/28 00:00", "YYYY/MM/DD HH:mm")"

AND path.msu.id = "12"

GROUPBY user.name,

                 user.domain,

                 path.device.name,

                 path.absname;

example without the groupby just to show no errors:

user_name	user_domain	access_count	path_device_name	path_absname	path_msu_id	formatdate(timestamp,YYYY-MM-DD HH:mm)
Ailene	SAMGWIN.local	178	emcvnx	\\emcvnx\profile	12	2014-12-23 07:47