serial
Serializes the input in tuple units to run commands whose order is important and passes the subquery results by concatenating them.
Syntax
serial [ SUBQUERY ]
Required Parameter
SUBQUERY
- Subquery that can process the stream, enclosed in a pair of square brackets (
[ ]
).
Usage
Apply the CEP function (evtctxgetvar(), evtctxsetvar()) by row
table iis
| # Serializing CEP operations
| serial [
search cs_uri_stem == "*game*"
| evtctxadd topic=TEST key=cs_uri_stem maxrows=0 true
| eval prev_ip = evtctxgetvar("TEST", cs_uri_stem, "prev_ip")
| eval _dummy = evtctxsetvar("TEST", cs_uri_stem, "prev_ip", c_ip)
]
| fields _time, cs_method, prev_ip, c_ip, cs_uri_stem, cs_uri_query