updated cloudera_navigator_audit.sh

cloudera_navigator_audit.sh

@@ -39,20 +39,28 @@
 #   ./cloudera_navigator_audit.sh <query> ... > navigator_audit_log.csv
 #
 #
-# Last year only (literally today minus 1 year right down to the second):
+# Last year of Impala queries (literally today minus 1 year right down to the second):
 #
-#   ./cloudera_navigator_audit.sh "1 year ago" <query> ... > navigator_audit_log_year.csv
+#   ./cloudera_navigator_audit.sh "1 year ago" service==impala ... > navigator_audit_log_year.csv
 #
 #
-# From Start to End Dates:
+# All Privilege Grants up to now:
 #
-#   ./cloudera_navigator_audit.sh "2019-01-01T00:00:00" "2020-01-01T00:00:00" <query> ... > navigator_audit_log_2019.csv
+#   ./cloudera_navigator_audit.sh command==GRANT_PRIVILEGE > navigator_audit_log_grants.csv
+#
+#   ./cloudera_navigator_audit.sh command==REVOKE_PRIVILEGE > navigator_audit_log_revokes.csv
+#
+#
+# From Start to End Dates, all hive queries in 2019:
+#
+#   ./cloudera_navigator_audit.sh "2019-01-01T00:00:00" "2020-01-01T00:00:00" service==hive ... > navigator_audit_log_hive_2019.csv
 #
 #
 # All logs up to now for the Impala service, ignoring the self-signed certificate:
 #
 #   ./cloudera_navigator_audit.sh service==impala -k > navigator_audit_log_impala.csv
 #
+#
 # XXX: looks like there is a bug in the Navigator API returning only admin for when start date set to 1970-01-01T00:00:00 - workaround is to use 1970-01-01T00:00:01
 
 set -euo pipefail