1. Home
    2. Security Operations
    3. Cortex XDR
    4. Cortex XDR™ XQL Language Reference
    5. Stages Commands Reference
    6. Config
    7. timeframe

    timeframe

    Cortex XDR XQL timeframe configuration enables performing searches within a specific time frame from the query execution.

    Synopsis

    • Relative Time
       
      config timeframe = <
      number
      ><
      time unit
      >
    • Exact Time
       
      config timeframe between "<
      Year-Month-Day H:M:S ±Timezone
      >" and "<
      Year-Month-Day H:M:S ±Timezone
      >"

    Description

    The
    timeframe
     configuration enables you to perform searches within a specific time frame from the query execution. The results for the time frame are based on times listed in the
    _Time
     column in the results table.
    You can add the
    timeframe
     configuration to your queries using two different formats depending on whether the time frame you are setting is a relative time or an exact time.
    When you set a relative time, the
    config timeframe
     is set to
    <number><time-unit>
    , where you choose the
    <time-unit>
     from the available time-unit options listed in the table below.
    When you set an exact time, include the
    config timeframe
     details:
    between "<Year-Month-Day H:M:S ±Timezone>" and "<Year-Month-Day H:M:S ±Timezone>"
    . The
    ±Timezone
     format is:
    ±xxxx
    . When you do not configure a timezone, the default is
    UTC
    .

    Available Time Units

    Time Unit
    Description
    S
    seconds
    M
    minutes
    H
    hours
    D
    days
    W
    weeks
    MO
    months
    Y
    years
    The time unit is not case sensitive.

    Examples

    • Relative Time
      For the last 10 hours from when the query runs, return a maximum of 100
      xdr_data
       records.
      config timeframe = 10h 
| dataset = xdr_data 
| limit 100
    • Exact Time
      From April 1, 2021 at 9:00 a.m. UTC -02:00 until April 2, 2021 at 10:00 a.m. UTC -02:00, return a maximum of 100
      xdr_data
       records.
      config timeframe between "2021-04-01 09:00:00 -0200" and "2021-04-02 10:00:00 -0200" 
| dataset = xdr_data 
| limit 100

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo