XQL chart editor

T.Nurmi — Thu, 20 Feb 2025 12:23:17 GMT

Hi. just i'm little stuck...

config timeframe = 1y
|dataset= incidents
|filter (status in (ENUM.RESOLVED_FALSE_POSITIVE,RESOLVED_AUTO_RESOLVE))
|fields creation_time ,status
|alter month = format_timestamp("%m",creation_time )
|sort asc month
|comp count(status ) as total_auto_resolved_inc_month by month,status
| view graph type = column subtype = grouped xaxis = month yaxis = total_auto_resolved_inc_month

and i got this result>

and i like to get two different line with same month. Now there is those two different status for same line...

Re: XQL chart editor

aspatil — Thu, 27 Feb 2025 10:54:13 GMT

Hello @T.Nurmi ,

This took a whole lot of effort to make the query. Please refer to below:

config timeframe = 1y
| dataset = incidents
| filter status in (ENUM.RESOLVED_FALSE_POSITIVE, ENUM.RESOLVED_AUTO_RESOLVE)
| fields creation_time, status
| alter month = format_timestamp("%Y-%m", creation_time) // Year-Month format
| alter false_positive_count = if(status = ENUM.RESOLVED_FALSE_POSITIVE, 1, 0)
| alter auto_resolve_count = if(status = ENUM.RESOLVED_AUTO_RESOLVE , 1, 0)
| comp sum(false_positive_count) as false_positive_total, sum(auto_resolve_count) as auto_resolve_total by month
| replacenull false_positive_total = 0, auto_resolve_total = 0
| sort desc month

| view graph type = column subtype = grouped show_callouts = `true` xaxis = month yaxis = false_positive_total,auto_resolve_total seriescolor("false_positive_total","#ff0000") seriescolor("auto_resolve_total","#0000ff") xaxistitle = "Month" yaxistitle = "Number of Incidents" seriestitle("false_positive_total","Resolved False Positives") seriestitle("auto_resolve_total","Auto Resolved Incidents")

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

topic Re: XQL chart editor in Cortex XDR Discussions

XQL chart editor

Re: XQL chart editor