Table of Contents | ||||
---|---|---|---|---|
|
Overview
Instead of using the Devo interface, queries can also be directly written using LINQ language.
LINQ is the query language used by Devo to query data tables. LINQ syntax is very flexible as it allows to make a query expression very close to the data discovery process by:
selecting the source data table (using
from
)filtering data (using
where
)creating new
fields (using
select and optionally as
select
and optionallyas
...)grouping the data by a time value (using
group every
and
every
every
)applying aggregation operations over the grouped data (using
select
...as
...)
Code Block |
---|
from <table name>
group every <server |
period> by <field1>, |
<field2> every <browser period> select <aggregation operation 1>( |
<field>) |
as <NewfieldName1>, <aggregation operation 2>( |
<field>) |
as <NewfieldName2>, |
For example, the following is a LINQ query where we want to retrieve only those events with status code 404 grouped every 10 minutes, displaying the method and clientIpAddress columnsfields. Additionally, we have created the myCount column field to count the records in each interval. For more examples using different operations, see the LINQ query examples section.
Code Block |
---|
from demo.ecommerce.data where statusCode = 404 group every 10m by method, clientIpAddress every 10m select count() as myCount |
Sometimes you may have to create a column. The syntax would be:
Code Block |
---|
select <create column operation 1> as <NewColumnName1>,
create <column operation 2> as <NewColumnName2>, |
There are two different ways of accessing the query editor, where you can write your LINQ query:
In Data Search → search → Explore Your Data your data → Free Text Querytext query. Learn more about this option here.
After accessing a data table, you can build and edit the query by selecting the Query code editor icon in the query toolbar and clicking Run.
.
LINQ clauses
Find below a description of each of the general LINQ clauses you can use to query your data.
Expand | ||||||
---|---|---|---|---|---|---|
| ||||||
These are the necessary clauses you need to add to your LINQ query in order to perform a filtering operation:
For example, the following query performs a filter to get only those events where the number of bytes sent is greater than 800:
And this one returns the events where the client IP address is not null and the bytes transferred are less than 1000:
Learn how to filter using the search window interface in the following article: Filter data. |
Expand | |||||
---|---|---|---|---|---|
| |||||
These are the necessary clauses you need to add to your LINQ query in order to group data:
|
|
|
|
|
Adding two different grouping periods might look like an unnecessary complexity, but it brings many advantages, such as the optimization of the query response. The server period is smaller than the client period, so the information is sent from the server in smaller chunks. This allows you to apply other grouping periods from the browser without having to query the server again. An For example, the following query groups data by IP address and status code every 3 hours (client period). The server period has been set to 30 minutes to optimize performance.
Learn |
how to group using the search window interface, as well as the details about client and server |
periods in the following article: Group data. |
Expand | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
These are the necessary clauses you need to add to your LINQ query in order to perform an aggregation operation. You must always group the data before aggregating data.
For example, this query returns the average of bytes transferred every 5 minutes for each status code.
And this |
one returns the first non-null client IP address every 3 hours for each method.
Learn how to aggregate using the search window interface: Aggregate data. |
Expand | ||
---|---|---|
|
| |
These are the necessary clauses you need to add to your LINQ query in order to perform a create |
field operation. You must always include the |
field. Optionally, you can add an |
field. In case you don't add an |
field will be the operation( |
field).
For example, the following query creates two |
fields showing the corresponding latitude and longitude values of the IPs in the ClientIpAddress |
field of the table.
And this one displays the definitions of the status codes in a new |
field.
Learn how to create fields using the search window interface: Create fields. |