External DocumentationTo learn more, visit the QRadar documentation.
Parameters
| Parameter | Description |
|---|---|
| Query Expression | Query in AQL syntax to perform. |
Example Output
{
"cursor_id": "s16",
"compressed_data_file_count": 0,
"compressed_data_total_size": 0,
"data_file_count": 5470,
"data_total_size": 67183115,
"index_file_count": 0,
"index_total_size": 0,
"processed_record_count": 1256462,
"error_messages": [
{
"code": "String",
"contexts": [
"String"
],
"message": "String",
"severity": "String <one of: INFO, WARN, ERROR>"
}
],
"desired_retention_time_msec": 86400000,
"progress": 46,
"progress_details": [
0,
0,
0,
0,
66957,
652657,
76594,
89809,
86032,
107729
],
"query_execution_time": 1480,
"query_string": "SELECT sourceip, starttime, qid, sourceport from events into s16 where sourceip in (select destinationip from events) parameters snapshotsize=2, PROGRESSDETAILSRESOLUTION=10",
"record_count": 1240923,
"save_results": false,
"status": "String <one of: WAIT, EXECUTE, SORTING, COMPLETED, CANCELED, ERROR>",
"snapshot": {
"events": [
{
"sourceip": "10.100.65.20",
"starttime": 1467049610018,
"qid": 10034,
"sourceport": 13675
},
{
"sourceip": "10.100.100.121",
"starttime": 1467049610019,
"qid": 20034,
"sourceport": 80
}
]
},
"subsearch_ids": [
"sub_id_1"
],
"search_id": "s16"
}