Pragma value (pragmavalue)

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

Creates a column to extract the pragma values from a given query. Pragmas are components added to queries to modulate how certain pieces of information are processed without substantially altering the content (for example, locales or time zones).

How does it work in the search window?

Select Create column in the search window toolbar, then select the Pragma value operation. You need to specify three arguments:

Argument	Data type	Description

Argument	Data type	Description
Language ^mandatory	string	The programming language used to specify the query (for example, LINQ).
query ^mandatory	string	The full query you want to analyze.
pragma key ^mandatory	string	The section of the query where the desired pragma is located and thus the values to extract.

The data type of the values in the new column is string.

Example

Pragmas are not used on a general basis so we must artificially generate an example to see how this operation works. Let's say we want to extract the time zone from the following query:

from siem.logtrust.web.activity group every 5m by method pragma tz:\"Europe/Madrid\"

Syntax differences

Be aware that there are differences in syntax when you introduce the query using the interface or the Free Text Query. In this case, the backslashes "\" need to be removed when using the interface and kept when using the Free Text Query.

To do that, we will create two columns using the Pragma value operation and call them time_zone and locale.

The arguments needed to create the new column are:

Language - Click the pencil icon and introduce linq
query - Click the pencil icon and introduce from siem.logtrust.web.activity group every 5m by method pragma tz:"Europe/Madrid"
pragma key - Click the pencil and introduce tz

Click Create column and you will see the following result:

How does it work in LINQ?

Use the operator select... as... and add the operation syntax to create the new column. This is the syntax for the Pragma value operation:

pragmavalue(language_string, query_string, pragma_key_string)

Example

You can copy the following LINQ script and try the example above on the siem.logtrust.web.activity table.

from siem.logtrust.web.activity
group every 5m by method
select pragmavalue ("linq", "from demo.ecommerce.data pragma tz:\"Europe/Madrid\" pragma locale:\"es\"", "tz") as time_zone