serial

Serializes the input in tuple units to run commands whose order is important and passes the subquery results by concatenating them.

Syntax

serial [ SUBQUERY ]
SUBQUERY
Subquery that can process the stream, enclosed in a pair of square brackets ([ ]).

Usage

Apply the CEP function (evtctxgetvar(), evtctxsetvar()) by row

table iis 
| # Serializing CEP operations 
| serial [
  search cs_uri_stem == "*game*" 
  | evtctxadd topic=TEST key=cs_uri_stem maxrows=0 true
  | eval prev_ip = evtctxgetvar("TEST", cs_uri_stem, "prev_ip")
  | eval _dummy = evtctxsetvar("TEST", cs_uri_stem, "prev_ip", c_ip)
]
| fields _time, cs_method, prev_ip, c_ip, cs_uri_stem, cs_uri_query