Showing results for 
Search instead for 
Did you mean: 

DQL Query to find a specific filename

How do I look for a specific file?

Ie what’s the field for “filename” ?


Using DQL report, I can find all files with extension “url”

What do I change to find a specific file (HELP_DECRYPT.URL)


FROM   path

GET       absname,

size AS size_bytes,

formatdate(created_on,'YYYY/MM/DD HH:MM:SS Z') AS creation_time,

formatdate(last_accessed,'YYYY/MM/DD HH:MM:SS Z') AS last_accessed_time,

formatdate(last_modified,'YYYY/MM/DD HH:MM:SS Z') AS last_modified_time

IF           type = "FILE" AND

extension IN ("url")


1 Reply

Hey Darryl, Based on a DQL

Hey Darryl,

Based on a DQL example (IF clause), I believe filename would be "basename". The example from the UI:

FROM     path
get     name,
IF     basename IN ("ssn.csv","credit_cards.csv")