x

Implicit event relationships are relationships made either by namespacing as previously discussed or by shared index term. These relationships are not persisted like explicit relationships.

x

Explicit event relationships are relationships which are persisted in the iWay Enable metadata database. Using a Correlation ID (CID), iWay Enable captures events and relates them by assigning the same CID. iWay Enable relates all events occurring within a message together when it passes through an iWay Enable tap. All messages will each have their own CID.

x

Relating events at runtime requires using a new iFL function which creates a CID or takes a CID.

• _EXPOSECT(events, cid|ts, value) - takes a required list of events delimited by colons ':', a required CID or timestamp as a long or both delimited by a pipe, and an optional value. The iFL function will parse the value to determine the correct data type when creating the event table.
• _EXPOSER(events, value) - takes a required list of events delimited by colons ':' and an optional value. Like _EXPOSECT, this function will try to determine the data type of the value when creating the event table.

These functions are responsible for relating events. The _EXPOSE() function still exists and will continue to function as it did in iWay Enable 1.1, but it will not relate events.

x

When aggregating events, iWay Enable uses CIDs as foreign keys to perform joins between event tables. For example, the following iFL statement counts the number of blue phones:

_ecount('bluephones ')

As a result, the following iFL statement can count the number of blue phones which are lg:

_ecount('lg:bluephones')

The ':' character identifies relationships and delimits the events. The last event is the event being aggregated. In the latter case, the function is counting blue phones. In the following iFL statement, the function is counting lg and therefore counts the number of lg phones that are blue:

_ecount('bluephones:lg')

The following iFL statement counts the number of smart phones that are blue phones and lg:

_ecount('lg:bluephones:smartphone')

x

The Event Cloud on the Views page has changed from self-aggregating to displaying counts by relationships. Clicking on any event in the event cloud will return a set of events related to the selected event.