Custom Properties in AQL Queries
You can call a custom property directly in your AQL statements. If the custom property contains spaces you must use double quotation marks to encapsulate the custom property.
You must enable a custom property before you can use it in an AQL statement.
If the custom property is not enabled, you will be able to run your AQL query but you will not get results.
Custom Property Example
SELECT Bluecoat-cs-host, sourceip, Bluecoat-cs-uri FROM events WHERE LOGSOURCEGROUPNAME(devicegrouplist) ILIKE ’%Proxies%’ AND Bluecoat-cs-host ILIKE ’%facebook.com%’ GROUP BY sourceip
Bluecoat-cs-host is the host name
from the client's URL that is requested.
Bluecoat-cs-uri is the original URL
that is requested.