The Cisco ADQL event query begins with a SELECT clause, which can take one or more arguments.

SELECT * | {[DISTINCT] field_expression [AS alias] [, field_expression [AS alias]]...}

  • A single asterisk * in the SELECT clause returns the list of fields for each event.
  • To return specific fields for each event, specify a comma-separated list of fields. Optionally, each field_expression can be aliased to a label using the AS construct.

  • Use the DISTINCT qualifier to return unique combinations of the specified field values. If no limit specified, the top ten results by count are returned. See LIMIT Clause.
    DISTINCT can not be applied to a wild card SELECT query, such as 

    SELECT DISTINCT *
  • String values must be surrounded by either single quotes or double quotes, such as 'hello' and "hello".

The field_expression can take several forms. See Cisco ADQL Expressions.

Query Examples with SELECT Clause

QueryResult
SELECT count(transactionName) FROM transactions WHERE application='yourAppName'Returns a count of business transactions for the specified application.
SELECT * FROM logs WHERE sourceType='yourLogFile' AND message LIKE 'GET'Returns log events containing a specified keyword.
SELECT * FROM transactions WHERE application='yourAppName'  AND transactionName='yourBTName' Returns all fields for business transactions in the specified application matching the specified transaction name.
SELECT DISTINCT transactionName FROM transactions WHERE application='yourAppName'Returns a list of unique transaction names from the specified application.
SELECT customerName AS "First And Last Name", age AS "Years Old", ...Returns the specified fields relabeled as specified in the query statement. In this query, customerName and age are user-defined fields.