Developing Apama Applications > Developing Apama Applications in EPL > Defining Queries > Defining query input > Specifying maximum number of events in windows
Specifying maximum number of events in windows
In an input definition, you can specify a retain clause that indicates how many events can be in the window. For example:
query FraudulentWithdrawalDetection2 {
inputs {
Withdrawal() key userId retain 3;
}
find Withdrawal:w1 -> Withdrawal:w2 where w1.city != w2.city {
log "Suspicious withdrawal: " + w2.toString() at INFO;
}
}
In this query, only the most recent three Withdrawal events can be in the window. In other words, the window cannot contain more than three events. If only zero, one or two Withdrawal events with a particular key have arrived since the application was started then there would be only zero, one or two events, respectively, in the window.
The correlator evaluates the event pattern each time an event is added to the window. Suppose that at the indicated times the following events are added to the window in the partition identified by userId Dan:
Time
Event Added to Window
10:00
Withdrawal("Dan", "Dublin")
10:10
Withdrawal("Dan", "London")
10:20
Withdrawal("Dan", "London")
10:30
Withdrawal("Dan", "London")
11:30
Withdrawal("Dan", "Paris")
For the partition identified by the userId Dan, the query evaluates the pattern at the following times:
Time
Window Contents
Matching Events
10:00
Withdrawal("Dan", "Dublin")
10:10
Withdrawal("Dan", "Dublin")
Withdrawal("Dan", "London")
w1=Withdrawal("Dan","Dublin")
w2=Withdrawal("Dan","London")
10:20
Withdrawal("Dan", "Dublin")
Withdrawal("Dan", "London")
Withdrawal("Dan", "London")
w1=Withdrawal("Dan","Dublin")
w2=Withdrawal("Dan","London")
10:30
Withdrawal("Dan", "London")
Withdrawal("Dan", "London")
Withdrawal("Dan", "London")
11:30
Withdrawal("Dan", "London")
Withdrawal("Dan", "London")
Withdrawal("Dan", "Paris")
w1=Withdrawal("Dan","London")
w2=Withdrawal("Dan","Paris")
It is important to note that at 10:30, the Withdrawal("Dan", "Dublin") event that arrived at 10:00 is no longer in the window because the window retains three events at most and there are three Withdrawal events that have been added to the window more recently.
Copyright © 2013-2015 Software AG, Darmstadt, Germany and/or Software AG USA Inc., Reston, VA, USA, and/or its subsidiaries and/or its affiliates and/or their licensors.
Use, reproduction, transfer, publication or disclosure is prohibited except as specifically provided for in your License Agreement with Software AG.