Sentinel 7 Lucene Query

Question

We are having our own product which is used to get the data from
database of Sentinel-RD, Now because of our sudden change of Sentinel
version in our product integration. I had to write Lucene Queries to get
the data. Since i am very new to lucene queries, i am facing difficulty
to write appropriate queries in Lucene.
I will be using Sentinel 7 API to get the data from Sentinel 7 to our
product.
Below mention is the query which i had written in Sentinel RD , will
any buddy convert this query in Lucene or will any buddy will give
pointers to use of Sentinel 7 API.
SELECT /*+ FIRST_ROWS(1000)*/
case when event.RV45 is not NULL and event.dun is not NULL then
event.DUN ||'@'||event.RV45
when event.DUN is not NULL then event.DUN
when event.dhn is not NULL then event.dhn
when event.dip != -1 or event.dip is not NULL then
esec_utl.to_ip_char(event.dip) end as target,
case when xdas_tax.xdas_txnmy_name is not NULL then
xdas_tax.xdas_txnmy_name||'-'||xdas_tax.XDAS_OUTCOME_NAME
else tax.txnmy_lvl_1||'-'||tax.txnmy_lvl_2||'-'||tax.txnmy_lvl_3 end
as taxonomy,
case when event.evt is not NULL then event.evt else event.RV40 end as
Event_sub_type,
count(distinct(case when event.shn is not NULL then event.shn
when event.sip != -1 or event.sip is not NULL then
esec_utl.to_ip_char(event.sip)
else event.SUN end)) as sources,
count(case when event.sev in (5) then event.sev end) as critical,
count(case when event.sev in (4) then event.sev end) as high,
count(case when event.sev in (3) then event.sev end) as medium,
count(case when event.sev in (2) then event.sev end) as low,
count(case when event.sev in (0,1) then event.sev end) as
Information,
count(event.evt_id) as Event_Count
FROM
EVENTS event,
EVT_TXNMY tax,
EVT_XDAS_TXNMY xdas_tax
WHERE
event.cust_id = '$custId'
AND event.evt_time >= TO_DATE('$startDate', '$dbDateFormat')
AND event.evt_time <= TO_DATE('$endDate', '$dbDateFormat')
AND (event.RID02 in ($RecconSumm.XDAS) OR tax.txnmy_id in
($RecconSumm.LEGACY))
AND event.RID02 = xdas_tax.xdas_txnmy_id
AND event.txnmy_id = tax.txnmy_id
GROUP BY
case when event.RV45 is not NULL and event.dun is not NULL then
event.DUN ||'@'||event.RV45
when event.DUN is not NULL then event.DUN
when event.dhn is not NULL then event.dhn
when event.dip != -1 or event.dip is not NULL then
esec_utl.to_ip_char(event.dip) end,
case when xdas_tax.xdas_txnmy_name is not NULL then
xdas_tax.xdas_txnmy_name||'-'||xdas_tax.XDAS_OUTCOME_NAME
else tax.txnmy_lvl_1||'-'||tax.txnmy_lvl_2||'-'||tax.txnmy_lvl_3
end,
case when event.evt is not NULL then event.evt else event.RV40 end
ORDER BY critical DESC, high DESC, medium DESC, sources DESC, taxonomy
DESC
agupte
agupte's Profile: http://forums.novell.com/member.php?userid=97998
View this thread: http://forums.novell.com/showthread.php?t=448226

Answer 1

Hello agupte,
I'd be happy to help.
First, some knowledge:
- The Sentinel 7 APIs are fully documented through the Help menu
directly in the product itself.
- The Sentinel 7 Event Schema (fields) is also fully documented there,
so you can construct the right query.
Now, to do what you describe here you actually have two choices:
1) Use a Lucene query
2) Use a Data Sync policy to extract the events of interest to a
database, and then use your existing SQL query.
Your decision about using a data sync policy or not will basically come
down to the volume of data you'll need to extract - if you'll
essentially end up extracting all of the event data into a table, that's
probably not such a great approach. If, however, you're only interested
in a small subset of events (login events, perhaps, or just a count of a
certain type of event), then the data sync/table stuff should perform
reasonably well.
OK, so now for Lucene vs. SQL:
1) Lucene doesn't have a concept of selecting columns. So basically you
say "give me the events that have these properties" (the SQL WHERE
clause) and you get those events - not specific fields from those
events, but the whole enchilada.
2) You can't use any of the CASE/COUNT/etc business in Lucene either.
You'll have to do that sort of processing on the backend.
3) The Lucene data won't include any of the "mapped" data; it will
(typically) include GUIDs and integers and whatnot, and you may have to
map in the other data (like taxonomy) that you are currently JOINing.
I suspect that we'd be better able to help you if you could actually
explain your use case - what business objective you are trying to
achieve - since it's not entirely clear from your SQL query alone.
DCorlette
DCorlette's Profile: http://forums.novell.com/member.php?userid=4437
View this thread: http://forums.novell.com/showthread.php?t=448226