09-13-2023 08:27 AM
Hello @sushant1601
Thanks for reaching out on LiveCommunity!
Below is the description and comparison of the three fields.
_time -> It is the timestamp of the actual event that took place on endpoint. Its data type is Integer.
_insert_time -> It is the timestamp when the event was inserted in XDR database. Its data type is also integer.
insert_timestamp -> It is also the timestamp when the event was inserted into XDR database but its datatype is timestamp.
So if you are creating XQL query to fetch data based on insertion time of events then "insert_timestamp" is the field you are looking forward. Since it is of timestamp datatype so you can use timestamp related function available within XQL.
