Run query with XML data best practice

Exporting existing query XML definitions is a great way to learn how to create web URL queries.

In this example, export the "VSE: DAT Deployment XML" definition file and use those table objects to create a list of the Threat Prevention DAT file versions for each system in your network.

Export the existing query definition XML file and open it in a text editor.

Your export files look similar to this VSE: DAT Deployment XML definition file.

<list>
  <query>
    <dictionary/>
    <name>VSE: DAT Deployment</name>
    <description>Displays the three highest DAT versions, and a slice for all the other versions.</description>
    <target>EPOLeafNode</target>
    <table-uri>query:table?orion.table.columns=EPOComputerProperties.ComputerName%3AEPOComputerProperties.DomainName%3AEPOLeafNode.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate&amp;orion.table.order.by=EPOComputerProperties.ComputerName%3AEPOComputerProperties.DomainName%3AEPOLeafNode.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate&amp;orion.table.order=az</table-uri>
    <condition-uri>query:condition?orion.condition.sexp=%28+where+%28+version_ge+EPOProdPropsView_VIRUSCAN.productversion+%228%22+%29+%29</condition-uri>
    <summary-uri>query:summary?pie.slice.title=EPOProdPropsView_VIRUSCAN.datver&amp;pie.count.title=EPOLeafNode&amp;orion.query.type=pie.pie&amp;orion.sum.query=true&amp;orion.sum.group.by=EPOProdPropsView_VIRUSCAN.datver&amp;orion.sum.order=desc&amp;orion.show.other=true&amp;orion.sum.aggregation=count&amp;orion.sum.aggregation.showTotal=true</summary-uri>
  </query>
</list>

Open an existing web URL query file to use as a template, then save it with a new name. For example, URL_template.
Following is an example of an existing web URL template file.
```
https://<localHost>:8443/remote/core.executeQuery?
target=<tableTarget>&
select=(select <tableObjectNames>)
```
From the query definition XML file, find the query target listed between the target tags.
For example, <target>EPOLeafNode</target> and paste the target table name in target= of your template URL.
This is the template the URL with the target table name added.
```
https://<localHost>:8443/remote/core.executeQuery?
target=EPOLeafNode&
select=(select <tableObjectNames>)
```
From the query definition XML file, find the S-Expression function, listed between the opening and closing <condition-uri> ... </condition-uri> tags, then perform these steps:
1. In the URL template file, paste the object names in the select=(select parameter and the closing parenthesis. This example adds the EPOLeafNode.NodeName (system name) and EPOProdPropsView_VIRUSCAN.datver (VirusScan Enterprise DAT version) from the EPOLeafNode (System Tree) table.
```
https://<localHost>:8443/remote/core.executeQuery?
target=EPOLeafNode&
select=(select EPOLeafNode.NodeName EPOProdPropsView_VIRUSCAN.datver)
```
2. Add the sort order function. For example, to sort the output by system name, add the string "& order=(order(desc EPOProdPropsView_VIRUSCAN.datver)" in the existing S-Expression.
  The following example sorts the output by the Threat Prevention DAT version.
```
https://<localHost>:8443/remote/core.executeQuery?
target=EPOLeafNode&
select=(select EPOLeafNode.NodeName EPOProdPropsView_VIRUSCAN.datver&
order=(order(asc EPOProdPropsView_VIRUSCAN.datver))
```

Replace the <localHost> variable with your ePO - On-prem server DNS name, or IP address and paste the URL in your browser address bar. Your output should be similar to this output, but with many entries.

OK:
System Name: DP-2K12R2S-SRVR
DAT Version (VirusScan Enterprise): 

System Name: DP-EN-W7E1XP-2
DAT Version (VirusScan Enterprise): 

System Name: DP-W7PIP-2
DAT Version (VirusScan Enterprise): 7429.0000

System Name: DP-W7PIP-1
DAT Version (VirusScan Enterprise): 7437.0000
.
.
.

(Optional) To have the information appear in table format, paste the string :output=terse& before any ampersand in the URL and rerun the command. This is an example of your template file with :output=terse& added.

https://<localHost>:8443/remote/core.executeQuery?target=EPOLeafNode&:output=terse&select=(select EPOLeafNode.NodeName EPOProdPropsView_VIRUSCAN.datver)&
order=(order(desc EPOLeafNode.NodeName))

Confirm that your output is similar to the following example.

OK:
System Name     DAT Version (VirusScan Enterprise)
--------------- ----------------------------------
DP-2K12R2S-SRVR                                   
DP-EN-W7E1XP-2                                    
DP-W7PIP-2      7429.0000                         
DP-W7PIP-1      7437.0000                         
DP-2K8AGTHDLR   7437.0000                         
DP-2K8ER2EPO510 7465.0000                         
DP-W7PIP-3      7465.0000 
.
.
.

You have created a web URL query using the information exported from an existing XML query definition.