Active Lists

Search Anywhere Framework Streaming Correlator stores state shared between events and rules in active lists. These lists contain watchlists and accumulated attributes that rules read and populate while processing the event stream.

List Parameters

The active list editor contains the following parameters:

• List Name - required field; Latin letters, digits, _, and - are allowed
• Sources - data sources whose events populate the list
• Enable Automatic Population - allows the list to be populated from the event stream
• Stream Filter - a condition in the SML (RTC) dialect that selects events for automatic population
• Fields - the Field button adds a field with a required Name and a Key Field toggle. For each field, you can expand Mapping, which contains Source and Source Field Name pairs used to extract the field value from an event received from the corresponding source. Add Mapping adds another pair. Key fields form a composite record key used to find and update records when another match occurs
• Enable TTL - displays the TTL (sec) field, which specifies the record lifetime from the time it was last written

Replication and Placement

The Replication and Placement section determines which cluster nodes store the list:

• Replicas - number of additional list copies besides the primary copy
• Pin to Specific Nodes - enables manual placement. When disabled, placement of both the primary copy and replicas is determined automatically across all cluster nodes. When enabled, a table with the Node, Primary, and Replica columns appears. For each cluster node, the table specifies whether it is the primary (Primary) or one of the replicas (Replica) for this list

Using Active Lists in Rules

Rules access active lists through functions in the SML (RTC) dialect:

• alcontains - checks whether the list contains a record with the specified value