Preface
RulePoint
RulePoint Concepts
- RulePoint Concepts Overview
- Understanding RulePoint Entities
Using RulePoint
RulePoint Objects
- RulePoint Objects Overview
- State of RulePoint Objects
Working with Topics
Working with Connections
Working with Sources
Working with Responders
Working with Responses
Working with Watchlists
Working with Analytics
- Analytics Overview
- Analytic Types
- Creating an Analytic
- Copying an Analytic
- Editing an Analytic
- Deleting an Analytic
- Viewing Related Objects
- Predefined Analytics
  - abs
  - average
  - ceil
  - charat
  - clean
  - compareto
  - concat
  - confidence
  - correlation
  - count
  - current
  - date
  - datedifference
  - endswith
  - even
  - floor
  - getcurrentdate
  - getdatefrommillis
  - getdateinmillis
  - geodistance
  - geoinbound
  - geoinsidearea
  - geointersect
  - geooutbound
  - geooutsidearea
  - geopassthru
  - indexof
  - integer
  - isblank
  - isholiday
  - isnum
  - istext
  - isweekday
  - isweekend
  - large
  - list2vars
  - lower
  - max
  - min
  - mod
  - mode
  - mround
  - odd
  - parse
  - past
  - percentile
  - power
  - proper
  - range
  - regex
  - replace
  - round
  - rounddown
  - roundup
  - sign
  - small
  - startswith
  - stdev
  - stringequals
  - stringindexof
  - stringlastindexof
  - stringlength
  - substring
  - sum
  - trim
  - truncate
  - upper
  - xpath
- Predefined Operators
  - contains
  - equalsSet
  - has
  - in
  - match
  - notMatch
  - search
  - unique
  - group by
  - distinct
  - unmatched
- Using the distinct, group by, and ummatched Filters
DRQL
Working with Rules
Working with Alerts
Setting Access Controls
Troubleshooting RulePoint Issues
Connecting to an Ultra Messaging Application
Creating an Ultra Messaging JMS Source

User Guide

6.1.2
- 6.2
- 6.1

Back Next

Event Transformer Response Example

You can create a response with its default values using the following syntax:

WHEN 1 stock WITH symbol="XYZ" THEN TransformStockResponse

In this DRQL, TransformStockResponse is the name of the response.

If you want to override any of the default values in the response within the rule text, you can specify the changes in individual parameters. The DRQL in the following rule replaces the parameters for this service:

WHEN 1 stock WITH symbol="XYZ" THEN TransformStockResponse WITH params="volume=${volume}"

In the following example, an event with topic matchedstock is created for the first event of all matched stock events to a news event within a 60 minute window of the most current event (stock or news). The properties of the new event use the symbol and price from the first matched stock event in the window. The new event also contains the total number of stock within the window and the title from the news topic.

When  stock, 1 news with stock.symbol in news.title and count(stock.price) as total > 0 slide within 60 minutes then TransformsEvent with topic="stock(1) as matchedstock", properties="stock.*", params="last_hour_count=${total}, news_title=${news.title}"

For another example, this response describes a new event with topic matchedstock. It has all stock topic properties in the event. It does not contain news properties. The new event with topic matchedstock is created; it has title and reference from the news topic. The property title is renamed to reference_title. It does not contain stock properties.

WHEN sensor group by sensor.id,sensor.status WITH sensor.status ='down' ANDcount(sensor.status) = 5 slide within 5 minutes then TransformsEvent with topic="sensor(4:5) as FailedSensor", properties="*", detection_time="${drql_timestamp(rel), date hh:mm:ss.SSSSS}"

In the following example, the rule gathers all sensor events with the same sensor identifier and status within five minutes. If five sensor events in that time period have a status of ‘down’, then events with topic Failed Sensor are created for the last two matched sensor events. The detection_time property is set to the timestamp when each sensor event is consumed by RulePoint using the date format to include milliseconds. The property selector relative ‘rel’ selects the timestamp property relative to transformed sensor event.

WHEN sensor WITH match(sensor.id) AND match(sensor.status) AND sensor.status ='down' AND count(sensor.status) = 5 slide within 5 minutes then TransformsEvent with topic="sensor(4:5) as Failed Sensor", properties="*", detection_time="${drql_timestamp(rel), date hh:mm:ss.SSSSS}"

Rename Saved Search

Table of Contents

User Guide

User Guide

Event Transformer Response Example

Event Transformer Response Example