Skip to content

cq

Input Stack:
commonQuery: Query
expr: Expr
 ⇨ Output Stack:
Expr
 

Apply a common query filter to all query expressions within a complex expression tree. This operator traverses the expression and adds the common query as an AND condition to every query it finds. Non-query expressions (like constants or math operations) are left unchanged.

This is particularly useful for applying global filters (like application or region restrictions) to complex expressions that contain multiple queries.

Parameters

  • expr: The expression tree that may contain multiple queries
  • commonQuery: The query condition to AND with every query found in the expression

Examples

Apply a common application filter to an expression with multiple queries:

name,ssCpuUser,:eq,
name,DiscoveryStatus_UP,:eq,
:mul,
nf.app,alerttest,:eq,
:cq

This transforms:

  • name,ssCpuUser,:eq becomes name,ssCpuUser,:eq,nf.app,alerttest,:eq,:and
  • name,DiscoveryStatus_UP,:eq becomes name,DiscoveryStatus_UP,:eq,nf.app,alerttest,:eq,:and
BeforeAfter
name,ssCpuUser,:eq,
name,DiscoveryStatus_UP,:eq,
:mul,
nf.app,alerttest,:eq

name,ssCpuUser,:eq,
name,DiscoveryStatus_UP,:eq,
:mul,
nf.app,alerttest,:eq,
:cq

Non-query expressions are unaffected (42 remains unchanged):

BeforeAfter
42,nf.app,alerttest,:eq

42,nf.app,alerttest,:eq,
:cq
  • :and - Manually combine two query conditions
  • :freeze - Isolate expressions from common query operations