Descriptions of the fields in the Query Center table.
Notice
Building Cortex Query Language (XQL) queries in the Query Builder requires a Cortex XDR Pro license.
The table below lists the common fields in the Query Center.
Note
Certain fields are exposed and hidden by default. An asterisk (*) is beside every field that is exposed by default.
Field | Description |
|---|---|
BQL | Whether the query was created by the native search. Native search has been deprecated; this field allows you to view data for queries performed before deprecation. |
COMPUTE UNIT USAGE | Number of query units that were used to execute the API query and Cold Storage query. |
CREATED BY * | User who created or scheduled the query. |
DURATION (SEC) | Number of seconds it took to execute the query. |
EXECUTION ID | Unique identifier of Cortex Query Language (XQL) queries in the tenant. The identifier ID generated for queries executed in Cortex XDR and XQL query API. |
NUM OF RESULTS* | Number of results returned by the query. |
PUBLIC API | Whether the source executing the query was an XQL query API. |
QUERY DESCRIPTION* | Query parameters used to run the query. |
QUERY ID | Unique identifier of the query. |
QUERY NAME* |
 |
QUERY STATUS* | Status of the query:
|
RESULTS SAVED* | Yes or No. |
SIMULATED COMPUTE UNITS | Number of query units that were used to execute the Hot Storage query. |
TENANT | List of tenants on which an XQL query were executed. |
TIMESTAMP* | Date and time the query was created. |
XQL | Whether the query was created by an XQL search. |