This topic contains additional tips for working effectively with
EQL.
- String manipulations are
unsupported in EQL. Therefore, ensure you prepare string values for query
purposes in the data ingest stage.
- Normalize information to
avoid double counting or summing, as well as to prevent the production of
arbitrary values with multi-assign attributes.
- Use a common case (upper
case) for attribute string values when sharing attributes between data sources.
- Name each
DEFINE statement something meaningful so that others
reading your work can make sense of what your logic is.
- Use paging in
DEFINE statements to reduce the number of records
returned.
- When using
CASE statements, bear in mind that all conditions and
expressions are always evaluated, even though only one is returned. If an
expression is repeated across multiple
WHEN clauses of a
CASE expression, it is best to factor the computation
of that expression out into a separate
SELECT, then re-use it.