i have some facts in prolog.I want to define a rule that would print data about all amino acids in a formated way. here is the link that i have facts and some rules that i have defined myself. but i can not get formatting work , i mean i don't want to use multiple write()'s and even the tab formatting i cant get to work. here is my some logic but its not working. I just want to generate a report like format. Here is the link and code that i tried http://swish.swi-prolog.org/p/aminnoo.pl
> aminoname(_,H,ShortName),
>
> write(H),
> write(ShortName),nl, /* write(ShortName),
>
> %display [Hydropathy value]
> %format:aminoclass('Ala','Hydropathy','hydrophobic').
> aminoclass(ShortName,'Hydropathy',HydropathyValue),
> write(HydropathyValue),
>
> %display [Volume]
> %format:aminoclass('Ala','Volume','very small').
> aminoclass(ShortName,'Volume',VolumeValue),
> write(VolumeValue),
>
> %display [chemical value
> %format:aminoclass('Ala','Chemical','aliphatic').
> aminoclass(ShortName,'Chemical',ChemicalValue), write(ChemicalValue),nl,
> listAminoAcidProperties(T).*/
> listAminoAcidProperties(T).
i want it in this format
+-----------------------------------------------------------------+
| name | age | color | something |
-------------------------------------------------------------------
| xyz | 56 | hgchc | var |
-------------------------------------------------------------------
i am using this code:
format('+~`-t~78|+ ~n', []),
format('|~tTable Title~t~78||~n', []),
format('+~`-t~78|+ ~n', []).
format('| ~s~t~28|| ~s~t~36|| ~s~t~56|| ~s~t~80||~n',
['Name', 'Age', 'Eye Colour', 'Phone Number']).
but it is notgiving output as defined above
format/2 is a predicate that lets you format output in a similar fashion to the printf C function.
Related
I am working within Microsoft Sentinel Analytics Rules with the Kusto Query Language. (KQL)
I need to work in a Table called CrowdstrikeReplicatorLogs_CL which contains rows that contain a) data rows for which I need to alert on and b) metadata. that contains information about the subject in the alert.
This means I need to self-join the KQL table with itself to get the final result.
The column in question to join the table itself is the aid_g column.
ThreatIntelligenceIndicator
| where foo == bar
| join kind=innerunique (
CrowdstrikeReplicatorLogs_CL
| where TimeGenerated >= ago(dt_lookBack)
| where event_simpleName_s has_any ("NetworkConnectIP4", "NetworkConnectIP6")
| extend json=parse_json(custom_fields_message_s)
| extend ip4 = json["RemoteAddressIP4"], ip6=json["RemoteAddressIP6"]
| extend CS_ipEntity = tostring(iff(isnotempty(ip4), ip4, ip6))
| extend CommonSecurityLog_TimeGenerated = TimeGenerated
) on $left.TI_ipEntity == $right.CS_ipEntity
| join kind=innerunique (
CrowdstrikeReplicatorLogs_CL
| where custom_fields_message_s has "ComputerName"
| extend customFields=parse_json(custom_fields_message_s)
| project Hostname=customFields['ComputerName'], Platform=event_platform_s, aid_g
) on $left.aid_g == $right.aid_g
;
However, this raises a Query contains incompatible 'set' commands. error in Sentinel.
Is there a proper way to self-join tables?
I want to create a pie chart showing the counts of open (not closed) alerts which is working. However, I want it to default to 0 in the chart when there is no alert for a particular severity
alertsmanagementresources
|extend Sev = tostring(parse_json(properties.essentials.severity)),
LastModifiedTime = todatetime(properties.essentials.lastModifiedDateTime)
| where tostring(parse_json(properties.essentials.alertState)) <> 'Closed'
| where resourceGroup =='ai-eazyfuel-eu-prd-rg'
| where Sev =='Sev0'
|where LastModifiedTime >=datetime(2022/07/26)
|summarize count() by Sev
Is this even possible because I understand there are no results to show but you know what end users are like
While it's feasible to write the KQL query:
Azure Resource Graph uses only a limited subset of KQL which makes the query syntax cumbersome.
Azure Resource Graph cannot display 0 size slice.
P.S.
Please note the removal of unnecessary transformations of properties and the use of ISO format for datetime.
resources
| take 1
| mv-expand severity = range(0,4) to typeof(string)
| project severity = strcat("Sev", severity)
| join kind=leftouter
(
alertsmanagementresources
| extend severity = tostring(properties.essentials.severity)
,lastModifiedDateTime = todatetime(properties.essentials.lastModifiedDateTime)
| where properties.essentials.alertState <> "Closed"
and resourceGroup == "ai-eazyfuel-eu-prd-rg"
and severity == "Sev0"
and lastModifiedDateTime >= datetime("2022-07-26")
| summarize count() by severity
) on severity
| project severity, count_ = coalesce(count_, 0)
I have a dashboard populated with a number of Kusto KQL Queries.
Sometimes, my query below returns zero results (for instance if by miracle, there are no failures in the last 24 hours).
//my dashboard query
let failureResults = exceptions | where blahblahblah;
failureResults;
When there are no items that match the filters, my dashboard is filled with
'The query returned no Results'.
How could I go about checking if this variable is null and then doing a different op? For instance, if it's null, then I would just issue a print "No Failures for today, awesome!"; instead.
I have tried iff() statements and isempty(failures| distinct Outcome) and the like, but to no avail. For example, here is another one which didn't work:
failures | project column_ifexists(tostring(Outcome),"No failures where reported!")
Just thought on an improved solution based on pack_all() and the bag_unpack plugin
let p_threshold = ... ;// set value
let failureResults = datatable(exception_id:int,exception_val:int,exception_text:string)[1,100,"Hello" ,2,200,"World"];
failureResults
| where exception_val > p_threshold
| as t1
| project result = pack_all()
| union kind=outer (print msg = 'No Failures for today, awesome!' | where toscalar(t1 | take 1 | count) == 0 | project result = pack_all())
| evaluate bag_unpack(result)
let p_threshold = 0;
exception_id
exception_text
exception_val
1
Hello
100
2
World
200
let p_threshold = 300;
msg
No Failures for today, awesome!
Fiddle
Well... Kind of...
let p_threshold = ... ;// set value
let failureResults = datatable(exception_id:int,exception_val:int,exception_text:string)[1,100,"Hello" ,2,200,"World"];
failureResults
| where exception_val > p_threshold
| as t1
| union kind=outer (print msg = 'No Failures for today, awesome!' | where toscalar(t1 | take 1 | count) == 0)
| project-reorder msg
let p_threshold = 0;
msg
exception_id
exception_val
exception_text
1
100
Hello
2
200
World
let p_threshold = 300;
msg
exception_id
exception_val
exception_text
No Failures for today, awesome!
Fiddle
So I tried using OpenOffice Base and I had a hard time. Now, I have this SQL query here and it works well:
SELECT "CUSTOMER"."CREDIT_LIMIT" AS "CREDIT_LIMIT",
COUNT(*) AS "TOTAL_NUMBER"
FROM "CUSTOMER"
WHERE "SLSREP_NUMBER" = 6
GROUP BY "CREDIT_LIMIT";
Query:
| CRED_LIMIT | TOTAL_NUMBER |
| 1500 | 1 |
| 750 | 2 |
| 1000 | 1 |
Now my problem is when I add this : AND ("TOTAL_NUMBER" > 1)
SELECT "CUSTOMER"."CREDIT_LIMIT" AS "CREDIT_LIMIT",
COUNT(*) AS "TOTAL_NUMBER"
FROM "CUSTOMER"
WHERE "SLSREP_NUMBER" = 6 AND "TOTAL_NUMBER" > 1
GROUP BY "CREDIT_LIMIT";
Open Office would throw an Error: "Not a condition in statement"
My questions are: is there something wrong with my syntax? Have I written something wrong? or is my copy of OOBase defective? or am I missing something?
Update: I tried using HAVING as suggested by potashin (Thank you for answering) and it seems like it's still not working.
#potashin was close but didn't quite have it right. Do not say AS "TOTAL_NUMBERS". Also, Base does not require quotes around UPPER case names.
SELECT CUSTOMER.CREDIT_LIMIT AS CREDIT_LIMIT, COUNT(*)
FROM CUSTOMER
WHERE SLSREP_NUMBER = 6
GROUP BY CREDIT_LIMIT
HAVING COUNT(*) > 1
See also: http://www.w3resource.com/sql/aggregate-functions/count-having.php
The following statement always returns the result from st_area(st_buffer(polygon,100)).
select st_Area(polygon) as area,
case when area>100000 then st_area(st_buffer(polygon,500))
else st_area(st_buffer(polygon,100))
end from polygons limit 10;
area | st_area
------------------+------------------
383287.287473659 | 723738.615102036
47642.5395246768 | 192575.823383778
45546.753026985 | 174122.420564731
435204.455923533 | 725419.735987631
839954.564052786 | 1268251.88626391
315213.27742828 | 630424.785088617
966620.061916605 | 1447647.57269461
38446.6010009923 | 151584.647252579
82576.1182937309 | 238095.988431594
321682.125463567 | 695462.262796463
(10 rows)
st_area should have been the result of st_buffer(polygon,500) when area>100000 as shown below:
area | st_area
------------------+------------------
383287.287473659 | 2702203.34758147
47642.5395246768 | 192575.823383778
45546.753026985 | 174122.420564731
435204.455923533 | 2507469.89929028
839954.564052786 | 3568866.96452707
315213.27742828 | 2453576.33477712
966620.061916605 | 3953365.12876066
38446.6010009923 | 151584.647252579
82576.1182937309 | 238095.988431594
321682.125463567 | 2628693.69179652
(10 rows)
Can someone explain?
It doesn't become completely clear from the question (yet), but my educated guess is you want this:
SELECT st_Area(polygon) AS area -- or pick some other name!
, CASE WHEN st_Area(polygon) > 100000
THEN st_area(st_buffer(polygon,500))
ELSE st_area(st_buffer(polygon,100)) END AS st_area
FROM polygons
LIMIT 10;
You cannot reference the column alias (name of the output column) in another item of the same SELECT list. You can only reference input column names. So you have to repeat the expression or use a subquery:
SELECT area
, CASE WHEN area > 100000
THEN st_area(st_buffer(polygon,500))
ELSE st_area(st_buffer(polygon,100)) END AS st_area
FROM (SELECT st_Area(polygon) AS area, polygon FROM polygons LIMIT 10) sub;
Normally you should get a syntax error immediately. Obviously, there is another column named area in your base table. Hence the confusion. Additional wisdom to take away from this:
It's better to use a name different from any input column when attaching an alias to an output column.
Always include table definitions in questions. Clarifies a lot.