USE Statement

The USE statement defines which data models to query.

A data model is a way to view a set of events, including columns parsed off the event body. The data model defines which events to parse, how to parse them, and what columns to extract in order to execute this query.

The USE statement is an optional parameter, but it is a good practice to improve performance by reducing the set of event sources and set of parsers used.

<useStatement> ::= "USE" <identifier> ( "," <identifier> )* ;

The USE statement consists of the USE keyword followed by one or many data model names separated by commas. An <identifier> is a letter followed by any sequence of letters, digits, or an underscore (_).

Note: If you do not specify any data model in the Search field, the results are retrieved in the following order:
  1. All enabled built-in data model configurations
  2. All enabled data models that are not LogLogic LMI-specific but have source filters defined
  3. The system data model

The user-defined data models without the source filter are not included in the search query. For the list of built-in data models, see the Supported Log Sources list in the TIBCO LogLogic® Log Source PackagesInstallation and Upgrade, which is available on the TIBCO eDelivery website or TIBCO Support website after logging in. For more information about data models, see Data Models.

Certain data model expressions refer to a source of infrastructure data. This is defined by the corresponding data model itself and is typically defined by the name. The currently defined infrastructure data models are: LogLogic_Config_Bloks and LogLogic_Config_Models that represents the set of currently-defined Bloks and Data Model records respectively. For example, use LogLogic_Config_Bloks | COLUMNS name, origin, created, type, description, value

Do not use infrastructure queries within regular search queries. Infrastructure data model expression and an event data model expression are not allowed in the same query. An example of invalid mixed query is: use LogLogic_Config_Bloks, system.

Examples

Data Model Expression Definition
use Windows The result displays all events from Windows sources.
use Windows, Cisco The result displays all events from Windows and Cisco log sources.