# ever¶

Type of operation: Filter

## Description¶

When the verb input is a Resource dataset, ever selects all resources that at some point matched the predicate. ever may also be applied to a non-Resource dataset if it has a primary key. In that case, the primary key identifies groups of rows. ever selects all groups where at least one row in the group matches the predicate.

## Usage¶

ever predicate [ , frame ]


Argument

Type

Required

Multiple

predicate

bool

Required

Only one

frame

frame

Optional

Only one

## Accelerable¶

ever is accelerable if there is a frame() argument. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

## Examples¶

ever string(status_code) ~ /^5.*/


Select only resources where the status_code column, converted to string, starts with 5, at any point of the query time window. This formulation is not accelerable.

ever string(status_code) ~ /^5.*/, frame(back:30m)


Select only resources where the status_code column, converted to string, starts with 5, within the last half hour. This formulation is accelerable because the frame(back:30m) argument specifies a relative time range to check.

ever bytesUsed > 20000000


Assume the verb input is an Event dataset representing memory usage metrics. The input dataset has a Valid From field “timestamp”, a primary key (“deviceId”), and an additional column “bytesUsed”. The OPAL selects the “deviceId”s for which bytesUsed is above 20000000 at least once, and returns all rows for the selected “deviceId”s.