Sending data to WActionStores
The development pattern for WActionStores is:
CQ > WActionStore
More than one CQ may output to the same WActionStore.
In MultiLogApp, the four CQs in the following TQL output to the WActionStore UnusualActivity:
CREATE TYPE AccessLogEntry ( srcIp String KEY, userId String, sessionId String, accessTime DateTime, request String, code integer, size integer, referrer String, userAgent String, responseTime integer ); ... CREATE TYPE UnusualContext ( typeOfActivity String, accessTime DateTime, accessSessionId String, srcIp String KEY, userId String, country String, city String, lat double, lon double ); CREATE TYPE MergedEntry ( accessTime DateTime, accessSessionId String, srcIp String KEY, userId String, request String, code integer, size integer, referrer String, userAgent String, responseTime integer, logTime DateTime, logSessionId String, level String, message String, api String, sobject String, xception String, className String, method String, fileName String, lineNum String ); CREATE WACTIONSTORE UnusualActivity CONTEXT OF UnusualContext EVENT TYPES ( MergedEntry, AccessLogEntry) ); ... CREATE CQ GenerateHackerContext INSERT INTO UnusualActivity SELECT 'HackAttempt', accessTime, sessionId, srcIp, userId, IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP) FROM HackerStream LINK SOURCE EVENT; ... CREATE CQ GenerateLargeRTContext INSERT INTO UnusualActivity SELECT 'LargeResponseTime', accessTime, accessSessionId, srcIp, userId, IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP) FROM LargeRTAPIStream LINK SOURCE EVENT; ... CREATE CQ GenerateProxyContext INSERT INTO UnusualActivity SELECT 'ProxyAccess', accessTime, sessionId, srcIp, userId, IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP) FROM ProxyStream LINK SOURCE EVENT; ... CREATE CQ GenerateZeroContentContext INSERT INTO UnusualActivity SELECT 'ZeroContent', accessTime, accessSessionId, srcIp, userId, IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP) FROM ZeroContentAPIStream LINK SOURCE EVENT;
This WActionStore stores not just events of the UnusualContext type used by these four CQs, but also of the linked source events of MergedEntry and AccessLogEntry types. See Using EVENTLIST for details on querying the linked source events.