Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who rated this post

L4 Transporter

Hello @sushant1601 


Thanks for reaching out on LiveCommunity!

Below is the description and comparison of the three fields.

_time -> It is the timestamp of the actual event that took place on endpoint. Its data type is Integer.

_insert_time -> It is the timestamp when the event was inserted in XDR database. Its data type is also integer.

insert_timestamp -> It is also the timestamp when the event was inserted into XDR database but its datatype is timestamp.

So if you are creating XQL query to fetch data based on insertion time of events then "insert_timestamp" is the field you are looking forward. Since it is of timestamp datatype so you can use timestamp related function available within XQL.

View solution in original post

Who rated this post