Cortex XDR XQL bin stage enables grouping events by quantity or time.
- Quantitybin <field> bins = <number>Time Spanbin <field> span = <time> timeshift = <epoch time>DescriptionThebinstage enables you to group events by quantity or time span. The most common use case is for timecharts.You can add thebinstage to your queries using two different formats depending on whether you are grouping events by quantity or time span. Currently, thebinstage only supported using the equal sign (=) operator in your queries without any boolean operators (and,or).When you group events of a particular field by quantity, thebinstage is used withbinsto define how to divide the events.When you group events of a particular field by time, thebinstage is used withspan = <time>, where<time>is a combination of a number and time suffix. Set one time suffix from the list of available options listed in the table below. In addition, you can define a particular start time for grouping the events in your query according to the Unix epoch time by settingtimeshift = <epoch time>. Yet, this is optional. The query still runs without defining the epoch time. If notimeshift = <epoch time>is set, the query runs according to last time set in the log.When you group events by quantity, the<field>in thebinstage must be a number, and when you group by time, the<field>must be a date type. Otherwise, your query will fail.Time SuffixesTime SuffixDescriptionMSmillisecondsSsecondsMminutesHhoursDdaysMOmonthsYyearsThe time suffix is not case sensitive.Examples
- Quantity ExampleReturn a maximum of 1,000xdr_datarecords with the events of theaction_total_uploadfield grouped by 50MB. Records with theaction_total_uploadvalue set to 0 or null are not included in the results.dataset = xdr_data | filter action_total_upload != 0 and action_total_upload != null | bin action_total_upload bins = 50 | limit 1000Time Span ExampleReturn a maximum of 1,000xdr_datarecords with the events of the_timefield grouped by 1-hour increments starting from the epoch time 1615353499.dataset = xdr_data | bin _time span = 1h timeshift = 1615353499 | limit 1000
Recommended For You
Recommended videos not found.