This action (importData) imports data between the given dates into the Sentinel database so it can be used for historical reporting or other purposes. The data is imported into the following tables:
SQL Server
HIST_EVENTS
HIST_CORRELATED_EVENTS
Note: The tables are imported in Oracle with the same name they are archived with.
If the data has already been imported or there is no archived data is found between the specified dates, it returns a notification.
The application imports data from each file into a table and builds the historical view on all the historical tables. The report view joins on the original table and historical view. All Sentinel reports use the report view and thus will see any imported data.
This command uses the following flags:
-action |
importData |
-tableName |
<table name> |
-startDate |
<mm/dd/yyyy hh24:mi:ss> |
-endDate |
<mm/dd/yyyy hh24:mi:ss> |
-connectFile |
<filePath> |
Note: hh24 is hours represented in 24 hour format. For example, 1:15:00 p.m. is 13:15:00 and 3:00:00 a.m. is 03:00:00.
NOTE: The files to be imported must exist in the directory with their original file names.
To run importData:
Place all the files you wish to import in a specific directory (i.e., dirPath - <directory to import files from>) and execute the following command
-action importData -startDate <mm/dd/yyyy hh24:mi:ss> -endDate <mm/dd/yyyy hh24:mi:ss> -tableName <table name> -connectFile <filePath>
The following example imports the archived files from the tmp directory containing the data between dates "09/25/2007 00:00:00" (Sep 25 midnight) and "09/26/2007 00:00:00" (Sep 26 midnight).
Oracle Example:
./sdm action importData startDate 09/25/2007 00:00:00 endDate 09/26/2007 00:00:00 -tableName Events connectFile sdm.connect
SQL Server Example:
sdm action importData dirPath c:\tmp startDate 09/25/2007 00:00:00 endDate 09/26/2007 00:00:00 -tableName Events connectFile sdm.connect