Home
Guardian
User Guide
Information and resources about the main features of Guardian, and the tasks that you can do from the user interface (UI).
Queries
Queries
You can use the Nozomi Networks Query Language (N2QL) syntax to create complex data processes to obtain, filter, and analyze lists of information from the Nozomi Networks software.
Examples
Join
An example query to join two data sources to obtain a new data source with more information. In particular, how to list the links with the labels for the source and destination nodes.

Guardian
- Introduction
  An overview of Guardian.
- Installation Guide
  Information and resources on how to install Guardian, and the different options and settings that are available.
- Administrator Guide
  Information and resources about the Administration section of Guardian, and the tasks that you can do in this part of the software.
- User Guide
  Information and resources about the main features of Guardian, and the tasks that you can do from the user interface (UI).
  - Sensors
  - Alerts
  - Assets
  - Queries
    - Queries
      You can use the Nozomi Networks Query Language (N2QL) syntax to create complex data processes to obtain, filter, and analyze lists of information from the Nozomi Networks software.
      - Data sources
      - Basic operators
      - Commands
      - Functions
      - Examples
        Pie chart
        An example on how to create a pie chart to understand the media access control (MAC) vendor distribution in a network.
        Column chart
        An example on how to create a column chart with the top nodes by traffic.
        Where with multiple conditions in OR
        An example of a query to get all the nodes with a specific role, in particular all the nodes which are web or domain name server (DNS) servers.
        Bucket and history
        An example of a query to calculate the distribution of link events towards an internet protocol (IP) address.
        Join
        An example query to join two data sources to obtain a new data source with more information. In particular, how to list the links with the labels for the source and destination nodes.
        Compute the availability history
        An example query to compute the availability history for a link.
        Complex field types
  - Smart Polling
  - Arc
  - Network
  - Process
  - Reports
  - Assertions
  - Time machine
  - Vulnerabilities
  - Administration
  - Personal settings
- Maintenance Guide
  Information about the maintenance tasks of Guardian, to help you administer and maintain the solution in a production environment.
- Print format documentation
  A list of all the print-format documentation that is available for Guardian.

Join

An example query to join two data sources to obtain a new data source with more information. In particular, how to list the links with the labels for the source and destination nodes.

You can match the from field of the links with the id field of the nodes to ask for the links, and join them with the nodes:

links | join nodes from id

After executing the query above you will get all the links fields, plus a new field called joined_node_from_id, it contains the node which satisfies the link.from == node.id condition. You can use the dot syntax to access the sub fields of joined_node_from_id

Because we also want to get the labels for the to field of the links you add another join and exclude the empty labels of the node referred by to to get more interesting data:

links | join nodes from id | join nodes to id | where joined_node_to_id.label != ""

This will obtain a huge amount of data, which is difficult to understand. To only get the relevant information, you can use a select:

links | join nodes from id | join nodes to id | where joined_node_to_id.label != "" | select from joined_node_from_id.label to joined_node_to_id.label protocol

Join example — Figure 1. Join example