FROM clause

You must include a FROM clause in your statement to specify a record source.

A FROM clause is mandatory in a statement and specifies the source of records for an EQL statement, such as from a state name or from a previously-defined statement.

The FROM syntax is: 

FROM <recSource> [alias]
where <recSource> can be:

If you omit the FROM clause in your query, the EQL parser returns an error.

Previously-defined statement

You can use the result of a different statement as your record source. In the following example, the first statement (named RepQuarters) computes the total number of sales transactions for each quarter and sales representative. To then compute the average number of transactions per sales rep, a subsequent statement (named Quarters) groups those results by quarter: 
DEFINE RepQuarters AS
SELECT COUNT(TransId) AS NumTrans
FROM SaleState
GROUP BY SalesRep, Quarter;

RETURN Quarters AS
SELECT AVG(NumTrans) AS AvgTransPerRep
FROM RepQuarters
GROUP BY Quarter
The RepQuarters statement generates a list of records. Each record contains the attributes { SalesRep, Quarter, NumTrans }. For example: 
{ J. Smith, 11Q1, 10 }
{ J. Smith, 11Q2, 3 }
{ F. Jackson, 10Q4, 10 }
...
The Quarters statement then uses the results of the RepQuarters statement to generate a list with the attributes { Quarter, AvgTransPerRep }. For example: 
{ 10Q4, 10 }
{ 11Q1, 4.5 }
{ 11Q2, 6 }
...

State name

State names can be specified in EQL FROM clauses with this syntax: 
FROM <statename>[_FILTERED | _UNFILTERED | _ALL]
where:
  • statename_FILTERED represents the state with all filters applied (i.e., all the filters that are in the state of the query).
  • statename (i.e., using just the state name without a filtering qualifier) is a synonym for statename_FILTERED.
  • statename_UNFILTERED represents the state with only the security filter applied.
  • statename_ALL is a synonym for statename_UNFILTERED.
As an example, assume this simple Conversation Service query that uses the EQLQuery type: 
<Request>
   <Language>en</Language>
   <State>
      <Name>WineState</Name>
      <CollectionName>Wines</CollectionName>
      <DataSourceFilter Id="DataFltr">
        <filterString>WineType <> 'Red'</filterString>
      </DataSourceFilter>
      <SelectionFilter Id="SecFltr">
        <filterString>Price > 25</filterString>
      </SelectionFilter>
   </State>
   <EQLConfig Id="WineRecs">
      <EQLQueryString>
        RETURN results AS
        SELECT Price AS prices
        FROM WineState
        GROUP BY prices
      </EQLQueryString>
   </EQLConfig>
</Request>
The query works as follows:
  1. The DataSourceFilter filter (which is the security filter) first removes any record that has a WineType=Red assignment. In our small data set, only 11 records pass the filter. (Note that WineType must be single-assign or the query will fail.)
  2. The SelectionFilter filter then selects any record whose Price assignment is $25 or more. 7 more records are filtered out (from the previous 11 records), leaving 4 records.
  3. The FROM clause in the EQL statement references the state named WineState.

Thus, because the FROM clause in the EQL statement references the state named WineState, both filters from the state are applied and the 4 records are returned.