Declarative Rules

Creating a Rule

To create a declarative rule:

1. Open the rule list by going to Job Scheduler - Streaming Jobs, and click Create
2. Enter a Rule Name, and enable the rule using the Enable toggle
3. In Rule Type, select Declarative
4. In the Sources and Fields section, select the required aliases in Sources. Field mapping and the timestamp field are described in Rules

Correlation

On the Correlation tab, configure the condition and firing behavior:

1. In Firing Condition, enter an expression in the SML (RTC) dialect. The expression is evaluated for every incoming rule event, and the event is included if the expression returns true

2. Set Event Count Threshold to the number of events that must match the condition within the window for the rule to fire

3. Select a Refire Mode. This setting determines how often the rule fires while the group counter remains above the threshold:

   Value	When the Rule Fires
   On Threshold Crossing	Once whenever the value crosses the threshold from below
   For Each Event Batch	For every threshold-sized batch of events while the value remains above the threshold
   For Every Event Above Threshold	For every matching event while the value remains above the threshold

4. Select Grouping Fields. The rule counts events separately for each combination of these field values, maintaining a separate counter and generating a separate firing for each group

5. Set the Time Window using the Duration and Unit fields. This is the interval during which the rule accumulates events for comparison with the threshold

6. If necessary, enable Suppression Settings, and complete the Duration and Unit fields in the Suppression section that appears. After a firing, subsequent firings for the same group are suppressed for the specified period. A Duration of 0 disables suppression

Firing Format

On the Firing Format tab, define the contents of the firing document:

1. If Event Count Threshold is greater than one, add metrics in Event Aggregation Rules. The Metric button adds a row containing Source Field Name, Function, and Event Field. Each metric reduces the events in the window to one value, which is written to the firing document under the name specified in Source Field Name. Metrics are required when Event Count Threshold is greater than one and prohibited when the threshold is one. Unlike aggregation rules, declarative rules do not support a filter for an individual metric

   The Function field offers functions in the following order:

   count, sum, min, max, avg, dc, values, median, p95, p99, variance, stddev, first, last, earliest, latest, rate

   Event Field is required for every function except count and rate. If a field is specified for count or rate, only events containing that field are included in the calculation.

2. If necessary, select Save Source Events for Firing, and enter a Source Event Limit in Result Storage. When the checkbox is selected, SMRTC saves the events included in the firing and sends them to Search Anywhere Framework. The default limit is 100, and the maximum is 1000. If the limit is exceeded, the most recent events are retained

3. Click Save to create the rule