General S-Expression operations

and

Logical AND of two or more S-Expressions.

(where (and (eq OrionAuditLog.UserName "ga") (eq OrionAuditLog.Priority 1)))

or

Logical OR of two or more S-Expressions.

(where (or (eq OrionAuditLog.UserName "ga") (eq OrionAuditLog.UserName "admin")))

not

Logical negation of an S-Expression.

(where (not (eq OrionAuditLog.UserName "ga")))

eq

Logical comparison for equality.

(where (eq OrionAuditLog.UserName "ga"))

ne

Logical comparison for inequality.

(where (ne OrionAuditLog.UserName "ga"))

gt

Logical comparison for greater than.

(where (gt OrionAuditLog.Priority 1))

lt

Logical comparison for less than.

(where (lt OrionAuditLog.Priority 3))

ge

Logical comparison for greater than or equal.

(where (ge OrionAuditLog.Priority 2))

le

Logical comparison for less than or equal.

(where (le OrionAuditLog.Priority 2))

is_Blank

Returns the row if the column value is null or the trimmed value is empty.

(where (isBlank OrionAuditLog.UserName))

not_isBlank

Returns the row if the column value is not null or the trimmed value is not empty.

(where (not_isBlank OrionAuditLog.UserName)))

in

Returns the row if the following item (usually a property or value) is in a following list. This is similar to the SQL IN directive.

(where (in OrionAuditLog.UserName "ga" "bob"))

contains

Returns the row if the column value contains the stubstring argument value.

(where (contains OrionAuditLog.UserName "ga"))

notContains

Returns the row if the column value does not contain the stubstring argument value.

(where (notContains OrionAuditLog.UserName "ga"))

startsWith

Returns the row if the string starts with the supplied string. Similar to column in s% in SQL.

(where (startsWith OrionAuditLog.UserName "g"))

endsWith

Returns the row if the column ends with the argument value.

(where (endsWith OrionAuditLog.UserName "a"))

like

Returns the row if the column contains a value that matches the pattern. Similar to like in SQL.

(where (like OrionAuditLog.UserName "ga"))

newerThan

Returns the row if the first timestamp parameter is newer than the second timestamp parameter.

(where (newerThan OrionAuditLog.EndTime 3600000))

olderThan

Returns the row if the first timestamp parameter is older than the second timestamp parameter.

(where (olderThan OrionAuditLog.EndTime 36000000))

between

Returns the row if the timestamp or IP address argument (column or value) likes between the two values.

(where (between OrionAuditLog.EndTime (timestamp 1288888320000) (timestamp 1288888360000)))

beforeNow

Returns the row if the timestamp value (column or value) is before the current time.

(where (beforeNow OrionAuditLog.EndTime))

match_any

Returns the row if the IP address matches one in the following list.

(where(match_any EPOComputerProperties.IPV4x (ipv4 "192.168.1.1")))

notBetween

Returns the row if the IP address is not between the two argument addresses.

(where (notBetween EPOComputerProperties.IPV4x (ipv4 "192.168.1.1")(ipv4 "192.168.255.255")))

not_in_subnet

Returns the row if the address is not in the given subnet.

(where (not_in_subnet EPOComputerProperties.IPV4x (ipv4 "255.255.255.0" ) 25 ))

in_subnet

Returns the row if the address is in the given subnet.

(where (in_subnet EPOComputerProperties.IPV4x (ipv4 "255.255.255.0" ) 25 ))

in_ipv6_subnet

Returns the row if the address is in an IPv6 subnet.

(where (not_in_ipv6_subnet EPOComputerProperties.IPV6 (ipv6 "0.0.0.0") 1))

not_match_any

Returns the row if the argument IPv6 address does not match one of the argument addresses.

(where(not_match_any EPOComputerProperties.IPV6 (ipv6 "fc00::/7")))

Distinct

Selects records that contain a distinct output value in a given column. Similar to the SQL distinct directive.

(select (distinct) OrionAuditLog.UserName)

Note

If you use an order clause with select distinct, include the order columns in the selection.

Top N

Selects the first N records to display. N must be an integer. Similar to the Microsoft SQL Top, or the MySQL Limit clause.

(select (top 5) OrionTaskLogTask.Name OrionTaskLogTask.StartDate)