Name binding
It is sometimes necessary to use the result of calling a function more than once, for example using a result as part of a WHERE clause, and then using the value in a SHOW clause. To avoid repeated function evaluation, the result of a function can be bound to a name using a WITH clause. The result can then be referred to later by name, prefixed with an @ character. For example:
SEARCH Host
WITH creationTime(#) AS ctime
WHERE @ctime > parseTime("2007-06-01")
SHOW name, os, @ctime
Only function results can be bound to names in this way. It is not possible to directly use a logical or arithmetic expression. To do so, you can use the value() function as a wrapper around the expression:
SEARCH Host
WITH value(currentTime() - creationTime(#)) AS offset
WHERE @offset < 10000000 * 60 * 60 // one hour
SHOW name, os, @offset
Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*