topic Re: any way to have multiple counts within same xql query in Cortex XSIAM Discussions

any way to have multiple counts within same xql query

kadirerol — Thu, 23 Jan 2025 05:55:46 GMT

I need query about status of incidents. I have to all status count in same query. For example in april have 25 auto-resolved, 20 FP, 20 TP but I dont know how can i count in same query. Does anyone have any ideas on this topic?

Re: any way to have multiple counts within same xql query

john-lillington — Mon, 27 Jan 2025 12:12:09 GMT

Hi you could try this (amending timeframe to suit your needs):

config timeframe = 1mo
| dataset = incidents
| comp count() by status

Re: any way to have multiple counts within same xql query

kadirerol — Mon, 27 Jan 2025 12:23:38 GMT

Hi thanks for answer but I guess you misunderstand me. Actually I need it like below chart.For example the long one "auto resolve",the small one "fp.

Re: any way to have multiple counts within same xql query

john-lillington — Mon, 27 Jan 2025 12:55:31 GMT

You could modify the query to something like this:

config timeframe = 1mo
| dataset = incidents
| comp count() by status
| view graph type = column subtype = grouped xaxis = status yaxis = count_1

Re: any way to have multiple counts within same xql query

kadirerol — Mon, 27 Jan 2025 13:15:18 GMT

Thanks for answer. But This is not what I want.In the below I shared graph. Month 1st 178 FP,16 security testing ....I want to show same graph