20-22
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 20 Queries and Reports
Perform a Batch Query
Step 3
In the Query Event Data window, you can change the query criteria. (For more information on query
criteria, see
Query Criteria, page 20-10
). By clicking on various parameters you can change the nature
of the query. In this case we are specifying a Source IP address of
10.1.1.6
, a Destination IP address
range previously saved as
mygroup
, and setting the duration of the query to the past
2
days.Click either
Apply
button to apply your changes to the query. The Query Save/Submit window appears.
Figure 20-24
Query Save/Submit window
Step 4
The Query Save/Submit window asks you to choose from the options of
Save as Rule
,
Save as Report
,
or
Submit Batch
. To submit your query as a batch query, click
Submit Batch
. Your query is submitted,
and you are automatically taken to the Batch Query tab.
Figure 20-25
Batch Query Tab
Step 5
To watch the status of the query in real-time, you can use the Batch Query tab drop-down list to change
the
Page Refresh Rate
from
Never
(the default) to 1 minute, 3 minutes, 5 minutes, 10 minutes, 15
minutes, or 30 minutes.
