Adding query patterns
Before you can add a pattern to a query, you must add input definitions to the query. See
Adding query inputs .
To add a query pattern to a query
1. If the query definition is not already displayed in Query Designer, expand the project's queries folder and double-click the query file you want to edit.
2. In the Query Designer Design tab, from the Palette, drag and drop an event onto the canvas to the right.
3. To add a second event to the pattern, drag the event type from the Palette onto the canvas so that it hovers over the event that is already there.
The same event type can appear multiple times in a pattern. Query Designer automatically gives each event in the pattern a unique identifier.
Query Designer displays the followed-by (->), or and and operators before and after the event that is already in the pattern.
4. Drag the event you are adding to the appropriate operator so that it is highlighted and drop it.
Query Designer displays the updated pattern.
5. To add another event to the pattern, drag it from the Palette onto the canvas.
6. To relate the event being added to one of the events already in the pattern, hover the event being added over the event that is already in the pattern.
To relate the event being added to two or more events already in the pattern, hover the event being added over the space between those events.
Query Designer displays the followed-by (->), or and and operators before and after the event(s) that is (are) already in the pattern.
7. Drag the event you are adding to the appropriate operator so that it is highlighted and drop it.
Query Designer displays the updated pattern.
8. Repeat the previous three steps to add each additional event in the pattern you are looking for.
9. To add a period of time that must elapse before or after the event pattern occurs, drag Wait (
) from the palette onto the canvas and hover over the pattern for prompts to indicate where you can drop it. A waiting period is allowed at the beginning or end of an event pattern; it is not allowed between events.
10. Drag the Wait operator to the followed-by (->) operator at the beginning of the pattern or at the end of the pattern so that -> is highlighted and drop it.
Query Designer displays the updated pattern. The Wait operator has a blue color in contrast to the green color of the events. Inside the Wait operator, Query Designer assigns a unique identifier and default time period of 10 seconds.
12. If you need to delete an event or Wait operator from a pattern, right-click it and select Delete.
13. If you want to change the name of an event identifier in the pattern, double-click that identifier and enter a new one. For information on the characters that an identifier may contain, see
Identifiers. After you define the query's event pattern, you might want to add conditions that determine when the query successfully finds a match for the pattern. See
Adding query conditions .