Name binding


It is sometimes necessary to use the result of calling a function more than once, for example using a result as part of a WHERE clause, and then using the value in a SHOW clause. To avoid repeated function evaluation, the result of a function can be bound to a name using a WITH clause. The result can then be referred to later by name, prefixed with an @ character. For example:


SEARCH Host
WITH creationTime(#) AS ctime
  WHERE @ctime > parseTime("2007-06-01")
  SHOW name, os, @ctime

Only function results can be bound to names in this way. It is not possible to directly use a logical or arithmetic expression. To do so, you can use the value() function as a wrapper around the expression:


SEARCH Host
WITH value(currentTime() - creationTime(#)) AS offset
  WHERE @offset < 10000000 * 60 * 60  // one hour
  SHOW name, os, @offset

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*