FROM

The FROM clause is used to specify the input format source(s) from which the query input records are to be read.

Remarks:

• The syntax and interpretation of the <from_entity> specified in the FROM clause depends on the input format used. For information on the syntax and interpretation of the <from_entity> values supported by each input format, refer to the Input Formats Reference.
• Regardless of the input format used, the <from_entity> specified in the FROM clause must comply with the following general syntax:
  • The <from_entity> must be a single element or a list of elements, separated by the ',' (comma) or ';' (semicolon) characters, as in the following examples:

    file1.txt
    file1.txt, file2.txt
    file1.txt; D:\file2.txt; file3.txt
    

  • Each element can not contain spaces, ',' (comma) characters, or ';' (semicolon) characters, unless the element is enclosed by the ''' (single quote) or '" (double quotes) characters, as in the following example:

    file2.txt, 'C:\Program Files\file3.txt', file4.txt
    

  • The following characters are considered parenthesys characters, and if they appear in an element, they must appear as well-formed pairs of opening and closing parenthesys:

    < > ( ) [ ] { }

    The following examples show valid from-entities containing parenthesys characters:
    

    entity<value>
    entity[value]value
    

    The following examples show invalid from-entities containing parenthesys characters:
    

    entity>value<
    entity}value
    entity(value
    

• Any character (including illegal characters and non-printable characters) in a <from-entity> can be entered using the \uxxxx notation, where xxxx is the 4-digit hexadecimal representation of the UNICODE character, as in the following example:

  C:\Program\u0020Files\file3.txt
  

• From-entities that represent names of files or directories are not allowed to contain the following characters, even when enclosed in quote characters or entered using the \uxxxx notation:

  tab carriage-return line-feed , ( ) " < >

Examples:

A. <from_entity> with the REG input format

The following example query reads input records from the registry using the REG input format:

SELECT *
FROM \HKLM\SOFTWARE

B. <from_entity> with the EVT input format

The following example query reads input records from the System and Security event logs using the EVT input format:

SELECT *
FROM System, Security

See also:

Basics of a Query
Input Formats Reference

© 2004 Microsoft Corporation. All rights reserved.