Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
562 Views 9 Replies Latest reply: Dec 20, 2013 12:20 PM by sroering RSS
blackinux Newcomer 41 posts since
Jul 28, 2011
Currently Being Moderated

Oct 30, 2013 4:49 PM

Web Reporter query

Hi, wonder if anyone knows how to build a query that would exclude facebook.com\plugins since ill get many false positive for users that aren’t getting directly to facebook. I have try different combinations in the exclude tab but none will pass past www.facebook.com Thanks.

  • sroering McAfee SME 458 posts since
    Feb 10, 2011
    Currently Being Moderated
    1. Oct 31, 2013 9:20 AM (in response to blackinux)
    Re: Web Reporter query

    You would need to run a report using the detailed data set, and you would need to filter the URL column on the "colum properties" tab of the query.  In the exclude box, put your pattern.  *www.facebook.com/plugins*

     

    But you can expect performance to be much slower than other reports because this is a costly operation.

  • sroering McAfee SME 458 posts since
    Feb 10, 2011
    Currently Being Moderated
    3. Nov 1, 2013 7:53 AM (in response to blackinux)
    Re: Web Reporter query

    Because you want to filter on the "path" part of the URL, you cannot use a standard siten ame filter. You must filter on the URL, which means you must use detailed data. But I recommend you use the standard filters whenever possible.  Putting your filters under the query are hidden and easily forgotten which may give you confusing results.

     

    However, Detailed Data has everything that summary data does, so this shouldn't be a limiting factor for you. They will just run slower than summary data reports because the detaild dataset is around 10x larger.

     

    here are a couple of tips for making detaled reports reflect summary reports.

    1) don't forget to check the "combine similar" checkbox on the second tab.  That will condense multiple lines from this

     

    www.mcafee.com  business   1111 bytes

    www.mcafee.com  business   2222 bytes

    www.mcafee.com  busiiness  4444 bytes

     

    into this

     

    www.mcafee.com  business  7777 bytes

     

    2) If you need to filter on the URL path, but only want to see the site name on the report, you still need to include URL in the report. On the column properties tab, you can click a checkbox to hide the URL from the report results, but still use your filter.  If you cannot hide the column, then the query type is probably a graph; make sure the column is not included on the graph results.

  • sroering McAfee SME 458 posts since
    Feb 10, 2011
    Currently Being Moderated
    5. Dec 17, 2013 3:30 PM (in response to blackinux)
    Re: Web Reporter query

    Not sure.  Search for the report name in the .../reporter/log/server.log

    A few lines after, you should see a SQL='SELECT ..... etc..... "  line.  Copy and past that query here so I can see it.

     

    We should not see scr_fct_exact_access.url  in the SELECT statement, and we should see a GROUP BY clause that has all or most of the columns in the select statement.

  • sroering McAfee SME 458 posts since
    Feb 10, 2011
    Currently Being Moderated
    7. Dec 19, 2013 1:36 PM (in response to blackinux)
    Re: Web Reporter query

    The query you posted does not match the description in your previous thread. You are missing columns in the select clause. But on a hunch, I tried to create it and I found what is likely a bug. I have the correct columns in the select (i.e. no URL), but appears that the url is still included in the group by clause. We was able to get the correct results if I removed the URL from the group by and run the query directly against the database.

     

    I'd recommend you open a support ticket.

  • sroering McAfee SME 458 posts since
    Feb 10, 2011
    Currently Being Moderated
    9. Dec 20, 2013 12:20 PM (in response to blackinux)
    Re: Web Reporter query

    You won't be able to work-around this issue by taking out the URL. From what you described, you are doing everything 100% correct.

     

    I'm saying that I tried to create the report you described from your description.  What I found appears to be a bug that has the symptoms you reported (similar lines not being grouped).  So I recommend you open a support ticket and we can give you better tracking of the issue. Just mention this thread in your support ticket.

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points