Cortex XDR XQL timeframe configuration enables performing searches within a specific time frame from the query execution.
- Relative Timeconfig timeframe = <number><time unit>Exact Timeconfig timeframe between "<Year-Month-Day H:M:S ±Timezone>" and "<Year-Month-Day H:M:S ±Timezone>"DescriptionThetimeframeconfiguration enables you to perform searches within a specific time frame from the query execution. The results for the time frame are based on times listed in the_Timecolumn in the results table.You can add thetimeframeconfiguration to your queries using two different formats depending on whether the time frame you are setting is a relative time or an exact time.When you set a relative time, theconfig timeframeis set to<number><time-unit>, where you choose the<time-unit>from the available time-unit options listed in the table below.When you set an exact time, include theconfig timeframedetails:between "<Year-Month-Day H:M:S ±Timezone>" and "<Year-Month-Day H:M:S ±Timezone>". The±Timezoneformat is:±xxxx. When you do not configure a timezone, the default isUTC.Available Time UnitsTime UnitDescriptionSsecondsMminutesHhoursDdaysWweeksMOmonthsYyearsThe time unit is not case sensitive.Examples
- Relative TimeFor the last 10 hours from when the query runs, return a maximum of 100xdr_datarecords.config timeframe = 10h | dataset = xdr_data | limit 100Exact TimeFrom April 1, 2021 at 9:00 a.m. UTC -02:00 until April 2, 2021 at 10:00 a.m. UTC -02:00, return a maximum of 100xdr_datarecords.config timeframe between "2021-04-01 09:00:00 -0200" and "2021-04-02 10:00:00 -0200" | dataset = xdr_data | limit 100
Recommended For You
Recommended videos not found.