{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"_parentId":{"value":"120924679"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"397096af-97ef-419d-866b-b7d454c95474"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"bd3dcaa9-227f-4151-8954-6ac62f7c252c"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Instead of using the Devo interface, queries can also be directly written using LINQ language.","type":"text"}]},{"type":"paragraph","content":[{"text":"LINQ is the query language used by Devo to query data tables. ","type":"text"},{"text":"LINQ syntax is very flexible as it allows to make a query expression very close to the data discovery process by:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"selecting the source data table (using ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"from","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"filtering data (using ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"where","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"creating new columns (using ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"select and optionally as","type":"text","marks":[{"type":"code"}]},{"text":"...)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"grouping the data by a time value (using ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"group every","type":"text","marks":[{"type":"code"}]},{"text":" and","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":" every","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"applying aggregation operations over the grouped data (using ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"select","type":"text","marks":[{"type":"code"}]},{"text":"... ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"as","type":"text","marks":[{"type":"code"}]},{"text":"...)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"from \ngroup every by , \nevery \nselect () as ,\n() as ,","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"For example, the following is a LINQ query where we want to retrieve only those events with status code 404 grouped ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"every 10 minutes, displaying the","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":" method ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}},{"type":"strong"}]},{"text":"and ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"clientIpAddress ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}},{"type":"strong"}]},{"text":"columns.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":" Additionally, we have created the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"myCount","type":"text","marks":[{"type":"strong"}]},{"text":" column to count the records in each interval. For more examples using different operations, see the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"LINQ query examples","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/Devo712/pages/120924711"}}]},{"text":" section.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"codeBlock","content":[{"text":"from demo.ecommerce.data\nwhere statusCode = 404\ngroup every 10m by method, clientIpAddress\nevery 10m\nselect count() as myCount","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":65.0},"content":[{"type":"media","attrs":{"width":909,"id":"c4871d6d-80c7-47e5-8279-c5d6ec0a2d1a","collection":"contentId-120924679","type":"file","height":419}}]},{"type":"paragraph","content":[{"text":"Sometimes you may have to create a column. The syntax would be:","type":"text"}]},{"type":"codeBlock","content":[{"text":"select as ,\ncreate as ,","type":"text"}]},{"type":"paragraph","content":[{"text":"There are two different ways of accessing the query editor, where you can write your LINQ query:","type":"text"}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"Data Search → Explore Your Data → Free Text Query","type":"text","marks":[{"type":"strong"}]},{"text":". Learn more about this option ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":".","type":"text"}]}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph","content":[{"text":"After accessing a data table, you can build and edit the query by selecting the ","type":"text"},{"text":"Query code editor","type":"text","marks":[{"type":"strong"}]},{"text":" icon in the query toolbar and clicking ","type":"text"},{"text":"Run","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":744,"id":"413dab0a-94d0-46c0-9d11-0efa506d26cf","collection":"contentId-120924679","type":"file","height":536}}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Filter data using LINQ","type":"text"}]},{"type":"paragraph","content":[{"text":"These are the necessary clauses you need to add to your LINQ query in order to perform a filtering operation:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"codeBlock","content":[{"text":"from

\nwhere ,\n\n...","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, the following query performs a filter to get only those events where the number of bytes sent is greater than 800:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"codeBlock","content":[{"text":"from demo.ecommerce.data \nwhere bytesTransferred > 800","type":"text"}]},{"type":"paragraph","content":[{"text":"And this one returns the events where the client IP address is not null and the bytes transferred are less than 1000:","type":"text"}]},{"type":"codeBlock","content":[{"text":"from demo.ecommerce.data \nwhere isnotnull(clientIpAddress),\n bytesTransferred < 1000","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Group data using LINQ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"paragraph","content":[{"text":"These are the necessary clauses you need to add to your LINQ query in order to group data:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"codeBlock","content":[{"text":"group every by , \nevery ","type":"text"}]},{"type":"paragraph","content":[{"text":"Adding two different grouping periods might look like an unnecessary complexity, but it brings many advantages, such as the optimization of the query response. The server period is smaller than the client period, so the information is sent from the server in smaller chunks. This allows you to apply other grouping periods from the browser without having to query the server again. An ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"every 0","type":"text","marks":[{"type":"code"}]},{"text":" is also allowed in the case you don’t want any grouping period.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"paragraph","content":[{"text":"For example, the following query groups data by IP address and status code every 3 hours (client period). The server period has been set to 30 minutes to optimize performance.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"codeBlock","content":[{"text":"from demo.ecommerce.data \ngroup every 30m by clientIpAddress, statusCode\nevery 3h","type":"text"}]},{"type":"paragraph","content":[{"text":"Learn more about client and server periods ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"here","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"link","attrs":{"href":"/wiki/spaces/Devo712/pages/120924379"}}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Aggregate data using LINQ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"paragraph","content":[{"text":"These are the necessary clauses you need to add to your LINQ query in order to perform an aggregation operation. You must always group the data before aggregating data. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"codeBlock","content":[{"text":"from

\ngroup every by , \nevery \nselect () as ,\n() as ,\n...","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, this query returns the average of bytes transferred every 5 minutes for each status code.","type":"text"}]},{"type":"codeBlock","content":[{"text":"from demo.ecommerce.data \ngroup every 5m by statusCode \nevery 5m select \navg(bytesTransferred) as AvgOfBytes","type":"text"}]},{"type":"paragraph","content":[{"text":"And this one","type":"text"},{"text":" returns the first non-null client IP address every 3 hours for each method.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"codeBlock","content":[{"text":"from demo.ecommerce.data \ngroup every 30m by method \nevery 3h \nselect nnfirst(clientIpAddress) as FirstNonNullIP","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create new columns using LINQ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"These are the necessary clauses you need to add to your LINQ query in order to perform a create column operation. You must always include the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"select","type":"text","marks":[{"type":"code"}]},{"text":" operator followed by the operation name and column. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"paragraph","content":[{"text":"Optionally, you can add an ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"as","type":"text","marks":[{"type":"code"}]},{"text":" operator if you want to choose the name of the new column. In case you don't add an ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"as","type":"text","marks":[{"type":"code"}]},{"text":" operator, the name of the new column will be the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"operation(column).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"em"}]}]},{"type":"codeBlock","content":[{"text":"from

\n select () as ,\n () as ,\n...","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, the following query creates two columns showing the corresponding latitude and longitude values of the IPs in the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"ClientIpAddress","type":"text","marks":[{"type":"strong"}]},{"text":" column of the table.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"codeBlock","content":[{"text":"from demo.ecommerce.data\n select mmlatitude(clientIpAddress),\n mmlongitude(clientIpAddress)","type":"text"}]},{"type":"paragraph","content":[{"text":"And this one displays the definitions of the status codes in a new column.","type":"text"}]},{"type":"codeBlock","content":[{"text":"from demo.ecommerce.data \nselect decode(statusCode, 200, \"Successful Login\", 400, \"Bad/Invalid Request\", 401, \"Invalid Password/Username\") as StatusCodeMessages","type":"text"}]}],"version":1}

Browser not supported