USE Statement

The USE statement defines which data models to query.

A data model is a way to view a set of events, including columns parsed off the event body. The data model defines which events to parse, how to parse them, and what columns to extract in order to execute this query.

The USE statement is an optional parameter, but it is a good practice to improve performance by reducing the set of event sources and set of parsers used.

<useStatement> ::= "USE" <identifier> ( "," <identifier> )* ;

The USE statement consists of the USE keyword followed by one or many data model names separated by commas. An <identifier> is a letter followed by any sequence of letters, digits, or an underscore (_).

Note: If you do not specify any data model in the Search field, the results are retrieved in this order:
  1. All enabled LogLogic built-in data model configurations
  2. All enabled data models that are non- LogLogic specific but have source filters defined
  3. The system data model

The user-defined data models without the source filter is not included in the search query. For a detailed list of built-in data models, see the Supported Log Sources list in the TIBCO LogLogic® Log Source Packages Release Notes. For more information about data models, see Data Models.

Certain data model expressions refer to a source of infrastructure data. This is defined by the corresponding data model itself and is typically defined by the name. The currently defined infrastructure data models are: LogLogic_Config_Blocks and LogLogic_Config_Models that represents the set of currently defined Bloks and Data Model records respectively. For example, use LogLogic_Config_Bloks | COLUMNS name, origin, created, type, description, value

Infrastructure queries should not be mixed with regular search queries. If an infrastructure data model expression is used in a search query, then no event data model expression is allowed in the same query and vice-versa. An example of invalid mixed query is: use LogLogic_Config_Bloks, system

Examples

Data Model Expression Definition
use Windows The result displays all events from Windows sources.
use Windows, Cisco The result displays all events from Windows and Cisco log sources.