XQL query between 2 dates

[FabioFerreira]

Hi,

I want to query a specific number of events between 2 dates.

I have this query below, but it is missing the "between current_date and last 5 minutes"

dataset = fortinet_fortiauthenticator_vm_raw | filter deviceSeverity != "information" | filter deviceSeverity != "notice" | filter deviceSeverity = "warning"
| comp count(msg) as counter
| filter counter > 5

Could you help pls

Regards,

[afurze · Accepted solution]

FabioFerreira,

You can use the config stage command to specify a timeframe like so...

config timeframe = 5m
| dataset = fortinet_fortiauthenticator_vm_raw | filter deviceSeverity != "information" | filter deviceSeverity != "notice" | filter deviceSeverity = "warning"
| comp count(msg) as counter
| filter counter > 5