Striim 3.9.7 documentation

Sending data to WActionStores

The development pattern for WActionStores is:

CQ > WActionStore

More than one CQ may output to the same WActionStore.

Here is a simple example created by following the instructions in Modifying an application using the Flow Designer. Note that the WActionStore's types must be created before the WActionStore, which must be created before the CQ that populates it.

CREATE TYPE PosSourceContext (
  MerchantId String KEY , 
  DateTime org.joda.time.DateTime , 
  Amount Double , 
  Zip String , 
  City String , 
  State String , 
  LatVal Double , 
  LongVal Double  
);

CREATE WACTIONSTORE PosSourceData
CONTEXT OF PosSourceContext
EVENT TYPES (PosSourceContext KEY (MerchantId))  
PERSIST NONE USING();

CREATE CQ GenerateWactionContext 
INSERT INTO PosSourceData
SELECT p.MERCHANTID,
  p.DATETIME,
  p.AUTHAMOUNT,
  z.Zip,
  z.City,
  z.State,
  z.LatVal,
  z.LongVal
FROM PosSource_TransformedStream p, ZipCache z
WHERE p.ZIP = z.Zip;

This is used to populate the dashboard created by following the instructions in Creating a dashboard.

In MultiLogApp, the CQs GenerateHackerContext, output to the WActionStore UnusualActivity

CREATE TYPE AccessLogEntry (
  srcIp String KEY,
  userId String,
  sessionId String,
  accessTime DateTime,
  request String,
  code integer,
  size integer,
  referrer String,
  userAgent String,
  responseTime integer
);
...

CREATE TYPE UnusualContext (
  typeOfActivity String,
  accessTime DateTime,
  accessSessionId String,
  srcIp String KEY,
  userId String,
  country String,
  city String,
  lat double,
  lon double
);
CREATE TYPE MergedEntry (
  accessTime DateTime,
  accessSessionId String,
  srcIp String KEY,
  userId String,
  request String,
  code integer,
  size integer,
  referrer String,
  userAgent String,
  responseTime integer,
  logTime DateTime,
  logSessionId String,
  level String,
  message String,
  api String,
  sobject String,
  xception String,
  className String,
  method String,
  fileName String,
  lineNum String
);
CREATE WACTIONSTORE UnusualActivity 
CONTEXT OF UnusualContext 
EVENT TYPES (
  MergedEntry KEY(srcIp),
  AccessLogEntry KEY(srcIp)
);
...

CREATE CQ GenerateHackerContext
INSERT INTO UnusualActivity
SELECT 'HackAttempt', accessTime, sessionId, srcIp, userId,
 IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP)
FROM HackerStream
LINK SOURCE EVENT;
...

CREATE CQ GenerateLargeRTContext
INSERT INTO UnusualActivity
SELECT 'LargeResponseTime', accessTime, accessSessionId, srcIp, userId,
  IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP)
FROM LargeRTAPIStream
LINK SOURCE EVENT;
...

CREATE CQ GenerateProxyContext
INSERT INTO UnusualActivity
SELECT 'ProxyAccess', accessTime, sessionId, srcIp, userId,
  IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP)
FROM ProxyStream
LINK SOURCE EVENT;
...

CREATE CQ GenerateZeroContentContext
INSERT INTO UnusualActivity
SELECT 'ZeroContent', accessTime, accessSessionId, srcIp, userId,
  IP_COUNTRY(srcIp), IP_CITY(srcIP), IP_LAT(srcIP), IP_LON(srcIP)
FROM ZeroContentAPIStream
LINK SOURCE EVENT;

This WActionStore stores not just events of the UnusualContext type used by these four CQs, but also of the linked source events of MergedEntry and AccessLogEntry types. See Using EVENTLIST for details on querying the linked source events.