ever predicate: bool, [frame(...)]?

When the verb input is a Resource dataset, ever selects all resources that at some point matched the predicate. ever may also be applied to a non-Resource dataset if it has a primary key. In that case, the primary key identifies groups of rows. ever selects all groups where at least one row in the group matches the predicate.

Categories

• Filter

Accelerable

ever is accelerable if there is a frame() argument. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples

ever string(status_code) ~ /^5.*/

Select only resources where the status_code column, converted to string, starts with 5, at any point of the query time window. This formulation is not accelerable.

ever string(status_code) ~ /^5.*/, frame(back:30m)

Select only resources where the status_code column, converted to string, starts with 5, within the last half hour. This formulation is accelerable because the frame(back:30m) argument specifies a relative time range to check.

ever bytesUsed > 20000000

Assume the verb input is an Event dataset representing memory usage metrics. The input dataset has a Valid From field "timestamp", a primary key ("deviceId"), and an additional column "bytesUsed". The OPAL selects the "deviceId"s for which bytesUsed is above 20000000 at least once, and returns all rows for the selected "deviceId"s.