from queryutils.databases import PostgresDB l = "lupe" p = PostgresDB(l, l, l) # p.connect() ##cursor = p.execute("SELECT id, text, time, is_interactive, is_suspicious, search_type, \ ## earliest_event, latest_event, range, is_realtime, \ ## splunk_search_id, execution_time, saved_search_name, \ ## user_id, session_id \ ## FROM queries \ ## WHERE text=%s" % p.wildcard, (text,)) # queries = [] # for idx, query in enumerate(p.get_interactive_queries()): # if idx > 10: break # queries.append(query) # # for query in queries: # text = query.text # print text # cursor = p.execute("SELECT id, text, time, is_interactive, is_suspicious, search_type, \ # earliest_event, latest_event, range, is_realtime, \ # splunk_search_id, execution_time, saved_search_name, \ # user_id, session_id \ # FROM queries \ # WHERE is_interactive=%s AND text=%s" % (p.wildcard, p.wildcard), (True, text)) # rows = cursor.fetchall() # print rows # # for q in p.get_interactive_queries_with_text(text): # print q
def print_eval_portions(query): eval = [] push = False for token in tokenize_query(query): if token.type == "PIPE": if len(eval) > 0: print " ".join(eval) eval = [] push = False if push: eval.append(token.value) continue if token.type == "EVAL": push = True eval.append(token.value) continue l = "lupe" p = PostgresDB(l, l, l) p.connect() cursor = p.execute("SELECT distinct text FROM queries") for row in cursor.fetchall(): querystring = row["text"] if querystring.find("eval") < 0: continue print_eval_portions(querystring) p.close()