select * from unified_log where last="1h" and predicate='processImagePath contains "mdmclient"';