NRQL allowing Where in Where

Hello fellow Relics!

This is hopefully a quick one, I was expecting the NRQL editor to complain about this kind of syntax;

SELECT count(message) FROM Log WHERE condition1 = 'xxx' WHERE condition2 LIKE '%yyy%'

But it appears to run successfully until used as an alert where it never closes based on the condition - as if only one of the WHERE’s is processed.

I’m in the process of testing the change of the second WHERE to an AND as it should have been from the beginning.

I’m currently assuming “loss of signal” is not part of the mix at this stage as I’m always receiving a count of zero when not triggered and following a successful trigger.

Is there a reason this syntax does not raise an error when been created?

Hi @martin.rowe1 - Can you provide a link to the incident that did not close due to the multiple WHERE clauses?

Hi @dkoyano

Thanks for following up.

Here’s a link to the original incident that failed to close.

However the “double where” was not the cause of the failure to close. Updating with an AND operator did not close the incident. A “loss of signal” setting was required.

Still curious why that syntax was allowed in the first place…

Hi @martin.rowe1 - I am glad you were able to get your LoS configured. I am not sure why the multiple where clause without the comma (,) was allowed but I was able to reproduce this without error. I assume that it is still grouping results into one bucket where the transaction name contains xxx , and another where the URL contains yyy.