XQL "call" functions from scripts library

[JillianSagun]

Hi Peeps,

So XQL has this call function to fetch results from a saved query in the query library. Lets take this for example:

call "All appdata executions for the past 30 days"

Now, the problem is that my saved query is waiting for a parameter "$hostname". Anyone have any ideas how to pass that parameter through XQL?

Or probably point me to a KB of some sorts.

Thanks a lot,

Jill

[JillianSagun]

Sorry
XQL "call" functions from query library I mean

[bbarmanroy]

Hi @JillianSagun 

Go to Query library, and paste the XQL query in the thread here for us to replicate and advise accordingly. I believe this might not be created by Palo Alto Networks.

[JillianSagun]

Hi Bbamanroy,

Yeah.. this one I created myself. Take this for example

=====

config case_sensitive = false timeframe = 7d
| preset = host_inventory_auto_runs
| filter endpoint_name = $Hostname and cmd in ("*appdata*","c:\users*")
=====
I'm taking $Hostname as a parameter for the query.

I have multiple saved queries in the library that requires a hostname to be passed and I wanted to be able to call them and probably use join/union to merge the results.

Sure I can use both join/union in the query but I want to make them flexible like:

I will use w, x, y, and z queries for a certain event 

w, x, and y for another

and so on..

Appreciate the response!

[bbarmanroy · Accepted solution]

This works for me:
call "Host Inventory Autorun" Hostname="Bisma"

[JillianSagun]

Weird.. I tried something similar but anyways thank you!

Works for me too.