https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/looking-for-a-xql-query-to-extract-the-systems-enabled-with-wsl/m-p/587817#M6728 <P>Hi ShubmanT281,</P> <P>&nbsp;</P> <P>Thanks for reaching out.</P> <P>&nbsp;</P> <P>I believe you can use this small query to gather the device count as per installed application.</P> <P>&nbsp;</P> <P>preset = host_inventory_applications<BR />| fields application_name ,endpoint_name<BR />| filter application_name = "app name"<BR />| comp count(endpoint_name) by application_name</P> <P>&nbsp;</P> <P>Let us know if this helps.</P> <P>&nbsp;</P> <P>Regards.</P> Thu, 23 May 2024 18:08:36 GMT mavega 2024-05-23T18:08:36Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/looking-for-a-xql-query-to-extract-the-systems-enabled-with-wsl/m-p/587377#M6715 <P>Hi All,<BR /><BR /></P> <P>I am looking for a XQL query to extract the number of machines that have WSL components installed? Does anyone had a similar requirements in the past.</P> Tue, 21 May 2024 10:03:47 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/looking-for-a-xql-query-to-extract-the-systems-enabled-with-wsl/m-p/587377#M6715 ShubhamT281 2024-05-21T10:03:47Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/looking-for-a-xql-query-to-extract-the-systems-enabled-with-wsl/m-p/587817#M6728 <P>Hi ShubmanT281,</P> <P>&nbsp;</P> <P>Thanks for reaching out.</P> <P>&nbsp;</P> <P>I believe you can use this small query to gather the device count as per installed application.</P> <P>&nbsp;</P> <P>preset = host_inventory_applications<BR />| fields application_name ,endpoint_name<BR />| filter application_name = "app name"<BR />| comp count(endpoint_name) by application_name</P> <P>&nbsp;</P> <P>Let us know if this helps.</P> <P>&nbsp;</P> <P>Regards.</P> Thu, 23 May 2024 18:08:36 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/looking-for-a-xql-query-to-extract-the-systems-enabled-with-wsl/m-p/587817#M6728 mavega 2024-05-23T18:08:36Z