Using clause


The using clause retrieves information from the event repository of the rule engine to be used in the context of a rule. You can use the using clause to retrieve data instances for a dynamic rule, or to retrieve instances of past events. The syntax for the using clause is as follows:

<EventClassName> (<Variable>)
where [<Expression> <CondOperator> <Expression>, ...]
      
using [ALL] {<DataClassName> (<Variable>)
         
where [<Expression> <CondOperator> <Expression>,
            <Expression> <CondOperator> <Expression>,
            ...];
      
<DataClassName> (<Variable>)
         
where [<Expression> <CondOperator> ,<Expression>,
            <Expression> ,CondOperator> <Expression>,
            ...];
      
... ;
}

To search for event instances, you must write a valid criteria block with a valid event class name instead of a data class name.

You can define indexes on events and data. Querying instances can be process intensive and might dramatically reduce cell performance. When there are only conjunctions (AND but no OR) in the using clause, the compiler performs the following optimizations:

  • Equality constraints against mc_ueid and mc_udid (like $D.mc_udid == <value>) are compiled to use the internal hash table associated with these special slots. 
  • Equality and order constraints (==, <, >, <=, >=, between, has_prefix) against key slots (a slot with facet key=yes) are compiled to use the internal key index.

    If you need to query potentially large tables but the above optimizations are not possible, consider declaring an index on the table and query the table by using the index. For more information, see Indexes-in-rules.

    You can use conditions in the using clause to set controls on event processing. For example, you can indicate that the remainder of a rule is to be skipped if no relevant data is located. The following table lists additional conditions that affect rule processing.

    Conditions for the using clause 

    Condition

    Result

    Only a single instance of the data is found in the repository.

    The rule is evaluated only for the single instance.

    No data that matches the specified criteria is found in the repository.

    The remainder of the rule is skipped.

    More than one instance of the data exists in the repository.

    Only the first data instance is retrieved.

    Warning

    Note

    You can alter this behavior by using the ALL keyword. If you use the ALL keyword and more than one instance of data is found, the rule is evaluated for each instance. The ALL keyword contains a hidden recursive mechanism that produces this result.

    The using clause in a rule contains several queries.

    The rule engine searches for an instance corresponding to the criteria in the first using query, then an instance for the criteria in the second query, until all queries are exhausted. At least one instance of each query must exist for the rule to evaluate.

    For a using clause to succeed, each of its queries must find a solution.

    If the ALL keyword is present in the using clause, the body of the rule is executed for all the possible combinations of the different query solutions.

    A condition in a query can refer to the slot values of the main event of the rule, data, or event, each of which is retrieved by preceding queries in the using clause.

    The ALL keyword is used in the using clause.

    The rule is evaluated for all combinations of the instances found.

    For example, if a using clause contains two blocks, the first block retrieving three instances and the second block five, the rule is evaluated a total of fifteen times.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC ProactiveNet 9.6