A QRadar analyst wants to limit the time period for which an AOL query is evaluated. Which functions and clauses could be used for this?
In QRadar, to limit the time period for which an AQL (Ariel Query Language) query is evaluated, the functions and clauses that can be used include START, STOP, LAST, NOW, and PARSEDATETIME. Specifically, the LAST function is used to define a relative time range for the query, such as 'LAST 2 DAYS'.
Lelia
2 months agoBenton
2 months agoMila
2 months agoElenor
2 months agoCarri
4 months agoZita
4 months agoAlishia
4 months agoDelfina
4 months agoChristiane
4 months agoMalcom
4 months agoKarma
5 months agoHelga
5 months agoMan
5 months agoDominque
5 months agoDenae
5 months agoLacey
5 months agoFletcher
6 months agoPaulina
6 months agoDahlia
7 months agoGerald
7 months agoDyan
7 months agoMartin
7 months agoPaz
7 months agoRaymon
30 days agoOlen
1 month agoRoyal
1 month ago