A query searches for an event pattern that you specify. You define a query in a file with the extension .qry. Each .qry file contains the definition of only one query.
If specified, any
package or
using statements must be before the
query declaration. See
Packages and
The using declaration.
You must specify an identifier for the query name. See
Identifiers. The convention for specifying the name of a query is to use UpperCamelCase, as shown in the example below.
Specification of query parameters is optional. See
Parameters section.
An
inputs section is required. It specifies at least one event type. These are the event types that the query operates on. See
Inputs section.
The
find statement is required. It specifies the event pattern of interest and a block that contains procedural code. See
Find statement.
Action definitions, in the same form as actions in events, are optional. See
Event actions.