Name binding

It is sometimes necessary to use the result of calling a function more than once, for example using a result as part of a WHERE clause, and then using the value in a SHOW clause. To avoid repeated function evaluation, the result of a function can be bound to a name using a WITH clause. The result can then be referred to later by name, prefixed with an @ character. For example:

SEARCH Host 
WITH creationTime(#) AS ctime 
  WHERE @ctime > parseTime("2007-06-01") 
  SHOW name, os, @ctime

Only function results can be bound to names in this way. It is not possible to directly use a logical or arithmetic expression. To do so, you can use the value() function as a wrapper around the expression:

SEARCH Host 
WITH value(currentTime() - creationTime(#)) AS offset
  WHERE @offset < 10000000 * 60 * 60  // one hour
  SHOW name, os, @offset