Skip to main content

Sending data to WActionStores

The development pattern for WActionStores is:

CQ > WActionStore

More than one CQ may output to the same WActionStore.

In MultiLogApp, the four CQs in the following TQL output to the WActionStore UnusualActivity:

CREATE TYPE AccessLogEntry (
  srcIp String KEY,
  userId String,
  sessionId String,
  accessTime DateTime,
  request String,
  code integer,
  size integer,
  referrer String,
  userAgent String,
  responseTime integer
);
...

CREATE TYPE UnusualContext (
  typeOfActivity String,
  accessTime DateTime,
  accessSessionId String,
  srcIp String KEY,
  userId String,
  country String,
  city String,
  lat double,
  lon double
);
CREATE TYPE MergedEntry (
  accessTime DateTime,
  accessSessionId String,
  srcIp String KEY,
  userId String,
  request String,
  code integer,
  size integer,
  referrer String,
  userAgent String,
  responseTime integer,
  logTime DateTime,
  logSessionId String,
  level String,
  message String,
  api String,
  sobject String,
  xception String,
  className String,
  method String,
  fileName String,
  lineNum String
);
CREATE WACTIONSTORE UnusualActivity 
CONTEXT OF UnusualContext 
EVENT TYPES (
  MergedEntry,
  AccessLogEntry)
);
...

CREATE CQ GenerateHackerContext
INSERT INTO UnusualActivity
SELECT 'HackAttempt', accessTime, sessionId, srcIp, userId,
 IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP)
FROM HackerStream
LINK SOURCE EVENT;
...

CREATE CQ GenerateLargeRTContext
INSERT INTO UnusualActivity
SELECT 'LargeResponseTime', accessTime, accessSessionId, srcIp, userId,
  IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP)
FROM LargeRTAPIStream
LINK SOURCE EVENT;
...

CREATE CQ GenerateProxyContext
INSERT INTO UnusualActivity
SELECT 'ProxyAccess', accessTime, sessionId, srcIp, userId,
  IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP)
FROM ProxyStream
LINK SOURCE EVENT;
...

CREATE CQ GenerateZeroContentContext
INSERT INTO UnusualActivity
SELECT 'ZeroContent', accessTime, accessSessionId, srcIp, userId,
  IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP)
FROM ZeroContentAPIStream
LINK SOURCE EVENT;

This WActionStore stores not just events of the UnusualContext type used by these four CQs, but also of the linked source events of MergedEntry and AccessLogEntry types. See Using EVENTLIST for details on querying the linked source events.