These functions relate to the results joined to one master data.
The lookup() function returns the master item contents from the results joined to the master data.
The function return value type varies in accordance with the contents specified for the third argument output item and in accordance with the existence of specifications.
The lookup() function format is as follows:
Specify the development asset ID of the master definition.
Describe the join-relational expression used when joining the event and the master.
Specify the master data item to be output.
The string() function format or the val() function format must be used, not the master item reference format.
If an output item is not specified, the existence of master data after the join (true/false) is returned.
The format used for output item is shown below.
Point
If multiple master data fulfill the join-relational expression, search condition evaluation is performed for each of the output item contents. If even one of the multiple master items fulfills the lookup expression, the result of the condition expression is TRUE.
Note
There are no literals indicating Boolean values (true/false). If the lookup() function is used without an output item specification, specify either the true() function or the false() function in the right side of the condition expression.
See
Refer to "2.6.1 Join-Relational Expression" for information on join-relational expression formats.
Refer to "2.4.9 Item References" for details.
If the string() function is specified for the output item, the string type is returned. If the val() function is specified for the output item, the numeric type is returned.
The following Boolean values are returned:
Return value | Explanation |
|---|---|
true | Master data that fulfills the join-relational expression exists. It is the same as the true() function result. |
false | Master data that fulfills the join-relational expression does not exist. It is the same as the false() function result. |
Example
If the input event C item and the master data X item were joined, that input event is extracted.
lookup("Mst", $C == $X) = true()
If the input event C item and the master data X item were joined and the Y item of the joined result master matches "Diana", that input event is extracted.
lookup("Mst", $C == $X, string($Y)) = "Diana"
The lookup_sum() function returns the sum of the contents of master items from the results of joining to master data.
If specified in an output expression, the second and third arguments are omitted and the sum of the contents of the master items joined by the join expression is returned.
The lookup_sum() function format is as follows:
Specify the development asset ID of the master definition.
Describe the join-relational expression used when joining events and a master.
Specify the master data and items for extracting the sum.
Point
The first numeric literal format string found is extracted from the master data items as a numeric and added to the sum.
If strings shown in master data items do not contain numerics, they are handled as 0 (they are not added to the sum).
If no master data items contain numeric, this function returns "null". If this function is specified in a condition expression, the condition expression is evaluated as being false (conditions not met).
Commas (,) appearing in the integer part are ignored.
If a decimal point is specified, all subsequent numerics up to the first appearance of a non-numeric character are assumed to be the decimal part.
Values having a maximum of 18 digits in the decimal part after the decimal point are valid. (Decimal parts that exceed 18 digits are truncated.)
Note
If the integer part, excluding leading zeros, exceeds 18 digits, an error message is output and the input events are discarded (processing of subsequent input events continues).
See
Refer to "2.6.1 Join-Relational Expression" for information on join-relational expression formats.
Refer to "2.4.9 Item References" for details.
If the conversion has operated normally, a numeric type is returned.
Example
If the input event C item and the master data X item were joined and the totaled result for the master data Y item is greater than 100, that input event is extracted.
lookup_sum("Mst", $C == $X, $Y) > 100
The lookup_count() function returns the count for the master items from the results of joining to master data.
If specified in an output expression, the second and third arguments are omitted and the count for the master items joined by the join expression is returned.
The lookup_count() function format is as follows:
Specify the development asset ID of the master definition.
Describe the join-relational expression used when joining events and a master.
Specify the master data item to be counted.
Point
If the content of the specified item is "null", it is not counted.
If all the contents of the specified item are "null", this function returns 0.
See
Refer to "2.6.1 Join-Relational Expression" for information on join-relational expression formats.
Refer to "2.4.9 Item References" for details.
If the conversion has operated normally, a numeric type is returned.
Example
Example of using the lookup_count() function
If the input event C item and the master data X item were joined, this example detects if the master data Y item count is smaller than 10.
lookup_count("Mst", $C == $X, $Y) < 10