cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

DQL Query to find a specific filename

How do I look for a specific file?

Ie what’s the field for “filename” ?

 

Using DQL report, I can find all files with extension “url”

What do I change to find a specific file (HELP_DECRYPT.URL)

 

FROM   path

GET       absname,

size AS size_bytes,

formatdate(created_on,'YYYY/MM/DD HH:MMSmiley FrustratedS Z') AS creation_time,

formatdate(last_accessed,'YYYY/MM/DD HH:MMSmiley FrustratedS Z') AS last_accessed_time,

formatdate(last_modified,'YYYY/MM/DD HH:MMSmiley FrustratedS Z') AS last_modified_time

IF           type = "FILE" AND

extension IN ("url")

SORTBY size DESC

1 Reply
Highlighted

Hey Darryl, Based on a DQL

Hey Darryl,

Based on a DQL example (IF clause), I believe filename would be "basename". The example from the UI:

FROM     path
get     name,
active_users.name
IF     basename IN ("ssn.csv","credit_cards.csv")