Example Where Clause Statements

The following example statements show how Where Clauses can be used in a number of different scenarios.

  • Select records with a message beginning with THRESHforEXA.

    MSG MATCHES "THRESforEXA"

  • Select records whose process type is "Extractor (0)" or "Extractor":

    PROCTYPE CONTAINS "Extractor"

  • Using the MpAvailability (AVMON) record, this Where Clause is looking for applications that are in a "down" state.

    CURSTATE = "DN" AND TYPE = "APPLICATION"

  • Using the NtNetworkInterface (NTNETINT) record, this Where Clause will report on all (>0) inbound packets containing errors and outbound packets that could not be sent due to errors.

    ERORRECV > 0 OR ERORSENT > 0

  • The following example is true when either the current state is not "UP" or when there is an application called "TESTAPPLI" and it last failed today.

    ID MATCHES "TESTAPPLI" AND TYPE="APPLICATION" AND LASTFAIL>StartofDay OR CURSTATE NOT MATCHES "UP"

  • In this example brackets are used to make sure that only those records with a FAILCNT>0 and an ID of either Z or WINWORD are selected.

    FAILCNT>0 AND (ID MATCHES "Z" OR ID MATCHES "WINWORD")

    Without the brackets, any record with a FAILCNT>0 and an ID of Z would be selected, plus any records simply with the ID of WINWORD.

  • Select records which are either for CDROM drives with a disk inserted, or not for a disk device that is currently down:

    (SUBDEV MATCHES "CDROM" AND CURSTATE MATCHES "UP") OR ((SUBDEV NOT MATCHES "CDROM" OR SUBDEV=EMPTY) AND (CURSTATE NOT MATCHES "UP") AND (TYPE NOT MATCHES "DISK"))

Provide feedback on this article