XQL query for incident report

[T.Nurmi]

I like to get a hint how i can build simple xql query for  overtime timeframe for incidents. I need to filter that data, but that kind report that i can show example monthly base report for customer. where there are data for each day

[nsinghvirk]

Hello @T.Nurmi 

Thanks for reaching out on LiveCommunity!

To get a comprehensive view of incidents over time please use "Incident Management" dashboard where you can interact with data based on various parameters like status, severity and assignment etc. You can also generate a report of it based on the timeframe that you want to see. You can also create a custom dashboard based on "Incident Management" by adding custom widgets for your particular use case.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[T.Nurmi]

Hi. Thanks for answer, but what i try to find is to get trend reports . example here is data for 30 days, but i like to get trend reports for this kind info> then able to see monthly report/by day

config timeframe between "30d" and "now"
| dataset = incidents
| filter (status in (ENUM.NEW,UNDER_INVESTIGATION ))
| filter (alert_sources != "fw")
| comp count(status) as counter by status

| view graph type = pie xaxis = status yaxis = counter

[kadirerol]

Hi,

Thanks for answer but I need to calculate month by month in the last 1 year. For example march 2024-april 2024 245 incident,april 2024-march 2024 230 incidents and in the same query.

[kadirerol · Accepted solution]

Ok. I found it.

config timeframe = 1y
|dataset= incidents
|filter (status = RESOLVED_AUTO_RESOLVE)
|fields creation_time ,status
|alter month = format_timestamp("%m",creation_time )
|sort asc month
|comp count(status ) as total_auto_resolved_inc_month by month
| view graph type = column subtype = grouped xaxis = month yaxis = total_auto_resolved_inc_month

[T.Nurmi]

Thanks 🙂 very good advice 

[T.Nurmi]

so if i want to compare example truepositive and falsepositive /month with year level> what i should add to query

[kadirerol]

Hi,

I guess you need below query

config timeframe = 1y
|dataset= incidents
|fields creation_time ,status
|alter month = format_timestamp("%m",creation_time )
|sort asc month
|comp count(status) as total_inc_month by month,status
|dedup total_inc_month ,status by asc month

| view graph type = column subtype = stacked xaxis = month yaxis = status,total_inc_month default_limit = `false` seriescolor("status","#ee0505") headerfontsize = 3 legendfontsize = 4 xaxistitle = "Status by month" yaxistitle = "Count"