Sending data to WActionStores
The development pattern for WActionStores is:
CQ > WActionStore
More than one CQ may output to the same WActionStore.
Here is a simple example created by following the instructions in Modifying an application using the Flow Designer. Note that the WActionStore's types must be created before the WActionStore, which must be created before the CQ that populates it.
CREATE TYPE PosSourceContext ( MerchantId String KEY , DateTime org.joda.time.DateTime , Amount Double , Zip String , City String , State String , LatVal Double , LongVal Double ); CREATE WACTIONSTORE PosSourceData CONTEXT OF PosSourceContext EVENT TYPES (PosSourceContext) PERSIST NONE USING(); CREATE CQ GenerateWactionContext INSERT INTO PosSourceData SELECT p.MERCHANTID, p.DATETIME, p.AUTHAMOUNT, z.Zip, z.City, z.State, z.LatVal, z.LongVal FROM PosSource_TransformedStream p, ZipCache z WHERE p.ZIP = z.Zip;
This is used to populate the dashboard created by following the instructions in Creating a dashboard.
In MultiLogApp, the CQs GenerateHackerContext, output to the WActionStore UnusualActivity
CREATE TYPE AccessLogEntry ( srcIp String KEY, userId String, sessionId String, accessTime DateTime, request String, code integer, size integer, referrer String, userAgent String, responseTime integer ); ... CREATE TYPE UnusualContext ( typeOfActivity String, accessTime DateTime, accessSessionId String, srcIp String KEY, userId String, country String, city String, lat double, lon double ); CREATE TYPE MergedEntry ( accessTime DateTime, accessSessionId String, srcIp String KEY, userId String, request String, code integer, size integer, referrer String, userAgent String, responseTime integer, logTime DateTime, logSessionId String, level String, message String, api String, sobject String, xception String, className String, method String, fileName String, lineNum String ); CREATE WACTIONSTORE UnusualActivity CONTEXT OF UnusualContext EVENT TYPES ( MergedEntry, AccessLogEntry) ); ... CREATE CQ GenerateHackerContext INSERT INTO UnusualActivity SELECT 'HackAttempt', accessTime, sessionId, srcIp, userId, IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP) FROM HackerStream LINK SOURCE EVENT; ... CREATE CQ GenerateLargeRTContext INSERT INTO UnusualActivity SELECT 'LargeResponseTime', accessTime, accessSessionId, srcIp, userId, IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP) FROM LargeRTAPIStream LINK SOURCE EVENT; ... CREATE CQ GenerateProxyContext INSERT INTO UnusualActivity SELECT 'ProxyAccess', accessTime, sessionId, srcIp, userId, IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP) FROM ProxyStream LINK SOURCE EVENT; ... CREATE CQ GenerateZeroContentContext INSERT INTO UnusualActivity SELECT 'ZeroContent', accessTime, accessSessionId, srcIp, userId, IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP) FROM ZeroContentAPIStream LINK SOURCE EVENT;
This WActionStore stores not just events of the UnusualContext type used by these four CQs, but also of the linked source events of MergedEntry and AccessLogEntry types. See Using EVENTLIST for details on querying the linked source events.