to_string

Cortex XDR XQL to_string function converts a number to a string.

Synopsis

to_string (<number>)

The

to_string()

function converts a number to a string.

Display the first non-NULL

action_boot_time

field value. In a second column called

abt_string

, use the concat function to prepend "str: " to the value, and then display it.

dataset = xdr_data 
| fields action_boot_time as abt 
| filter abt != null 
| alter abt_string = concat("str: ", to_string(abt)) 
| limit 1