Due to architectural differences, the LINQ syntax presents some particularities in the Devo APIs and the search window of the Devo app.
Therefore, keep in mind that copying a LINQ query from the search window and pasting it into an API request, or vice versa, might not work. Before examining the differences explained below, you can visit Build a query using LINQ to know the standard procedures when working with LINQ.
Alerts API
Note that due to technical reasons, the Alerts API is the only API that uses the LINQ syntax used in the search window of the Devo app. This is indicated in the different sections below.
Aggregation operations
Maximum (max) operations
When you use this operation in the Data Search to create a new field, you can add as many arguments as needed, however, the number of arguments is limited to two when used in APIs.
As a workaround, you can perform subsequent maximum operations until you have obtained the maximum of all the arguments you need.
Search window + Alerts API | Other Devo APIs |
---|---|
Syntax: Create field: Query example: from demo.ecommerce.data select max(bytesTransferred, timeTaken, statusCode) as `maxField` | Syntax: Create field: Query example: from demo.ecommerce.data select max(bytesTransferred, timeTaken) as maxFieldA, max(maxFieldA, statusCode) as maxFieldTotal |
Related articles: Maximum (max)
Minimum (min) operations
When you use this operation in the Data Search to create a new field, you can add as many arguments as needed, however, the number of arguments is limited to two when used in APIs.
As a workaround, you can perform subsequent minimum operations until you have obtained the minimum of all the arguments you need.
Search window + Alerts API | Other Devo APIs |
---|---|
Syntax: Create field: from demo.ecommerce.data select min(bytesTransferred, timeTaken, statusCode) as `minField` | Syntax: Create field: Query example: from demo.ecommerce.data select min(bytesTransferred, timeTaken) as minFieldA, min(minFieldA, statusCode) as minFieldTotal) |
Related articles: Minimum (min)
Arithmetic operations
Addition, sum, plus / Concatenation (add, +) operations
When you use this operation in the Data Search, you can add as many arguments as needed (where applicable), however, the number of arguments is limited to two when used in APIs.
As a workaround, you can perform subsequent adding operations until you have added all the arguments you need.
Search window + Alerts API | Other Devo APIs |
---|---|
Syntax: Create field: from demo.ecommerce.data select add(bytesTransferred, timeTaken, statusCode) as `totalField` | Syntax: Create field: Query example: from demo.ecommerce.data select add(bytesTransferred, timeTaken) as totalFieldA, add(totalFieldA, statusCode) as totalFieldFinal |
Related articles: Addition, sum, plus / Concatenation (add, +)
Multiplication, product (mul, *) operations
When you use this operation in the Data Search, you can add as many arguments as needed, however, the number of arguments is limited to two when used in APIs.
As a workaround, you can perform subsequent multiplication operations until you have multiplied all the arguments you need.
Search window + Alerts API | Other Devo APIs |
---|---|
Syntax: Create field:
from demo.ecommerce.data select mul(bytesTransferred, timeTaken, statusCode) as `resultField` | Syntax: Create field: Query example: from demo.ecommerce.data select mul(bytesTransferred, timeTaken) as resultFieldA, mul(resultFieldA, statusCode) as resultFieldTotal |
Related articles: Multiplication, product (mul, *)
Lookup operations
Regular operations
Queries that use lookup operations present some particularities that make them incompatible when used from the search window to APIs or vice versa. The use of symbols is different and the domain name is required in one of them.
Search window + Alerts API | Other Devo APIs |
---|---|
Syntax:
from demo.ecommerce.data select `lu/IP_list/StreetAddress`(clientIpAddress) as `IP street address` | Syntax:
Query example: from demo.ecommerce.data select lu("IP_list", "StreetAddress", clientIpAddress) as `IP street address` |
Related article: Data enrichment
JSON operations
Queries that use lookup operations with JSON present some particularities that make them incompatible when used from the search window to APIs or vice versa. The use of symbols is different and a specific json command is required in one of them.
Search window + Alerts API | Other Devo APIs |
---|---|
Syntax:
Query example: from demo.ecommerce.data select `lu/IP_list`(clientIpAddress) as `jsonField` | Syntax:
Query example: from demo.ecommerce.data select hlurjson("IP_list", clientIpAddress, eventdate) as `json` |
Related article: Data enrichment
Mlevalmodel operation
mlevalmodel
operation is not supported in search window. Use this operation in APIs when you want to work with models you uploaded in Model Management.
Search window | Devo APIs |
---|---|
| Query examples: from "datatable" select "fields" mlevalmodel("domain", "ModelName", "ModelFields") as "NameNewField" Example: from demo.ecommerce.data select split(referralUri, "/",2) as domain, float(lenght(domain)) as lenght shannonentropy(domain) as entropy float(countbyfilter(domain, "aeiuoAEIOU")) as p_vowels, mlevamodel("self", "example_test", lenght, entropy, p_vowels) as prob ifthenelse(prob>0.8, "dga", "legit") as type |
Refer article: Model Management