[This is preliminary documentation and subject to change.]
The GROUP BY clause is used to reduce the flow of notifications by combining several notifications into a single aggregate notification. The aggregate notification is an instance of the system class __AggregateEvent, a class that contains two properties: Representative and NumberOfEvents. Representative is an object property that contains the event instance, while NumberOfEvents stores the number of events that were combined to form the single aggregate event.
The GROUP BY clause can be placed anywhere after the WHERE clause as is shown in the following syntax:
select <property_list> from <class> <where_clause>
GROUP BY property_list
The property list that follows the BY keyword is a comma-delimited list of properties that are included in the event class.
For example, the following statement requests notifications about instance modification events reporting changes to Win32_LogicalDisk instances. CIMOM groups all events that occur for a particular drive letter and sends one notification for each group. The notification is an instance of the __AggregateEvent class:
select * from __InstanceModificationEvent
where TargetInstance isa Win32_LogicalDisk
group by DriveLetter
Without the GROUP BY clause, the aggregate event would not provide any meaningful information about drive letters. Without the WITHIN clause, the consumer runs the potential risk of being flooded with notifications. Combining the WITHIN and GROUP BY clauses simplies the processing of event notifications and reduces excessive traffic.
Event providers implement the following tasks to support aggregated event notifications: