never predicate: bool, [frame(...)]?

Keeps every row whose primary-key group had no row where the predicate evaluated to true inside the chosen time window.

On a Resource dataset, that selects resources that never entered a matching state in scope; on other datasets with a primary key, each group is all rows sharing that key. The input must have a non-empty primary key (otherwise the compiler reports that the verb is used to filter grouped rows and suggests filter instead). Pair with ever for “at least once true” and always for “always true.”

The predicate must be bool. An optional second argument is frame using back and/or ahead only; start and end are not allowed. On temporal inputs without a frame, the compiler evaluates the condition over the query window and then compares groups, which is not accelerable; with a frame, accelerable predicates can accelerate. On a non-temporal (table) input, supplying frame() still produces an accelerable windowed plan. When the predicate is time-immutable or the input is non-temporal, the stage strength-reduces to filter on ifnull(not(pred), true) rather than a plain not(pred), so rows where pred is null are kept: null means the predicate was not definitely true, so it does not disprove never(pred).

Categories

• Filter

Accelerable

never is accelerable if there is a frame() argument. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples

never string(status_code) ~ /^5.*/

Keeps every row for hosts that never logged an HTTP 5xx status in the query window, even if some rows have other non-matching codes that are not server errors.

never string(status_code) ~ /^5.*/, frame(back:30m)

Uses frame(back:30m) so the “no 5xx ever” test is limited to the half-hour leading each row, which matches the accelerable windowed pattern for temporal data.

never bytesUsed > 20000000

Assuming deviceId is the primary key, returns all intervals for devices that never crossed the twenty-megabyte threshold, including rows where bytesUsed might be null because null is not treated as a definitive threshold breach for never.