Adding query time constraints (within)
A query time constraint sets the time period during which the set of events that match the pattern of interest must have been received. A query can specify zero, one or more time constraints. A time constraint can apply to the whole pattern or a portion of the pattern.
To add a time constraint to a query
2. In the Query Designer Conditions pane, click the down arrow next to the plus sign and select Time constraint (within). 3. In the New Time Constraint dialog, if the time constraint applies to all events in the pattern then leave All events in the pattern selected and skip the next step. Otherwise, select Only specific events.
For example, suppose you want to flag consecutive Withdrawal events for the same account that have different country field values. However, this is of interest only when the consecutive events both arrive within an hour. In this case, the time constraint applies to all events in the pattern.
4. To apply the time constraint to a portion of the pattern, select at least two events. The time constraint applies to only the events you select.
For example, suppose that the pattern of interest is an A event followed by a B event followed by a C event. However, this pattern is of interest only when the C event is received within 10 seconds after the B event. You want the time constraint to apply only to the B and C events and so you need to select those two events.
5. In the field at the bottom of the dialog, specify the period of time during which the selected events must be received. The elapsed time from when the first selected event is received to when the last selected event is received must be less than the time period you specify. See
Specifying a time period in Query Designer. 6. Click OK.
Query Designer displays the new time constraint in a row in the
Conditions pane. To modify this time constraint, select it and then click
. To remove this time constraint, select it and then click
. Also, the new time constraint is immediately added to the source code as a
within clause in the
find statement. If you modify the time constraint in the
Source tab this is reflected in the
Conditions pane in the
Design tab.