Negating an Argument for XML API Query

[Molly_Rice]

I am essentially trying to query the XML API for the active firewall to grab out operational logs using the below query except I would like to NEGATE the application so that I am grabbing out the logs that do not include that application type. Right now as it is written below, I am grabbing out ONLY the logs with application type "example-application-type-here" and I would like the opposite. Has anyone resolved this?

<show><session><all><filter><application>example-application-type-here</application></filter></all></session></show>

Thanks!

[Brandon_Wertz]

---

@Molly_Rice wrote:

I am essentially trying to query the XML API for the active firewall to grab out operational logs using the below query except I would like to NEGATE the application so that I am grabbing out the logs that do not include that application type. Right now as it is written below, I am grabbing out ONLY the logs with application type "example-application-type-here" and I would like the opposite. Has anyone resolved this?

<show><session><all><filter><application>example-application-type-here</application></filter></all></session></show>

Thanks!

---

Can you use a 'not' operator somewhere in-front of the application field or maybe the 'bang' !  ?

[BPry]

@Molly_Rice,

The way that you would do this through the API (and the way that the GUI actually performs this) is simply not outputting the full return. Something a bit like this:

session_table = requests.get('https://<firewall>/api/?type=op&cmd=<validate><full></full></validate>',headers=headers, verify=False)
session_dict = xmltodict.parse(session_table.content)
returned_session_list = []
session_list = session_dict['response']['result']['entry']
for session in session_list:
    if session['application'] == 'ssl':
        logging.debug("Drop Session")
    else:
        returned_session_list.append(session)
## Do something with returned_session_list ##