Distributed Advanced Search

Requirements to run distributed Advanced Search queries

You can use distributed queries in Advanced Search if all of the following requirements are met:

• The Management Station setup includes the required Remote Appliances. For information about how to set up a Management Station, see Manage Appliances with Management Station in the TIBCO LogLogic® Log Management Intelligence Administration Guide.
• You have permission to access the Remote Appliances and devices on which the search query is to be run.
• Advanced Features are enabled on the Management Station and Remote Appliances.
• The data node port (9621) on each Remote Appliance is accessible by the Management Station.

Using the sys_concentratorId column

You can specify the value of sys_concentratorId using =, ==, or the IN construct. Valid values for sys_concentratorId can be any of the following:

• Explicit appliance IP addresses, where the IP addresses must exist in the Management Station list on the Management > Management Station page.
• Appliance grouping shortcuts, similar to those used in the Log Source Picker in Advanced Search.
• Enrichment lists

Using Enrichment Lists in the sys_concentratorId column

Enrichment lists can also be used in distributed Advanced Search queries to specify sets of appliances to which the query must be sent.

For example, you can create an enrichment list called MyApplianceSets with mappings such as:

{ "set1" : "127.0.0.1, <IP1>, <IP2>", 
"set2" : "<IP3>" }

USE system | sys_concentratorId = $MyApplianceSets('set1') | sys_body CONTAINS 'joe'

USE system | DeviceInGroup('MyLogLogicAppliances', $MyApplianceSets('set1') ) | sys_body CONTAINS 'joe'

Using the DeviceInGroup function

DeviceInGroup("<Group Name>", "<IP list or appliance grouping shortcuts>")

• <Group Name> is the name of the device group
• <IP list or appliance grouping shortcuts> specifies the list of appliance concentrator IP addresses on which the device group is to be evaluated

Local device groups

You can also run the query on local device groups that use the same name on multiple appliances. For example, if the local device group MyLocalGroup exists on two appliances, Appliance1 (having IP address IP1) and Appliance2 (having IP address IP2), and you have permissions on MyLocalGroup on both appliances, then using the following function in a distributed Advanced Search query on the Management Station:

DeviceInGroup("MyLocalGroup", "<IP1>, <IP2>")

causes the query to be sent to both appliances Appliance1 and Appliance2, for their corresponding local group MyLocalGroup. Search results from all devices belonging to the MyLocalGroup device group on both appliances are sent back to the Management Station.

Global device groups

If you create a global device group GlobalGroup on the Management Station that includes log sources from Appliance1 and Appliance2, you can use the global group name in the DeviceInGroup function:

DeviceInGroup("GlobalGroup", "ALL")

This query is sent to Appliance1 and Appliance2.

Global Dynamic Device Groups

In regular expression search, it is not possible to run distributed queries on dynamic device groups because dynamic device groups cannot have a global scope.

However, for distributed Advanced Search queries, if you create local dynamic device groups that have the same group name on the appliances involved, and run a distributed Advanced Search query for those local dynamic device groups, you can achieve the effect of a global search result on dynamic device groups.

For more information about device groups, seeGUID-54C6B42C-8C37-4359-B289-44696D01CA36.html.

Limitations and errors

Limitations

You cannot use the Tail functionality in distributed Advanced Search.

Errors

An error is displayed if:

• The specified appliance shortcut is invalid.
• An appliance specified in the distributed query is not a member of the Management Station setup.

Examples of distributed Advanced Search queries