You can include a
FROM clause in your statement to specify a different
record source from the result of the containing search and navigation query.
Its syntax is as follows:
FROM <statementKey> [alias]
By default, the source of records for an EQL statement is the result of
the containing search and navigation query. However, you can also include the
FROM syntax in your statement to specify a different
record source, either from the corpus or from a previously defined statement,
whether that statement is a
DEFINE or a
RETURN.
Two names identify a corpus-based source:
- AllBaseRecords: Every
record that passed the security filter.
- NavStateRecords:
Every record that passed all previous filters.
Note: If you want to submit your query against
NavStateRecords, you do not need to include the
FROM syntax in your statement. The absence of
FROM implies
NavStateRecords.
You can also use the result of a different statement as your record
source. In the following example, a statement computes the total number of
sales transactions for each quarter and sales representative. To then compute
the average number of transactions per sales rep, a subsequent statement groups
those results by quarter.
DEFINE RepQuarters AS
SELECT COUNT(TransId) AS NumTrans
GROUP BY SalesRep, Quarter;
RETURN Quarters AS
SELECT AVG(NumTrans) AS AvgTransPerRep
FROM RepQuarters
GROUP BY Quarter
The
RepQuarters statement generates a list of records. Each
record contains the attributes
{ SalesRep, Quarter, NumTrans }. For example:
{ J. Smith, 11Q1, 10 }
{ J. Smith, 11Q2, 3 }
{ F. Jackson, 10Q4, 10 }
...
The
Quarters statement then uses the results of the
RepQuarters statement to generate a list with the
attributes
{ Quarter, AvgTransPerRep }. For example:
{ 10Q4, 10 }
{ 11Q1, 4.5 }
{ 11Q2, 6 }
...