Learn more about the Cortex Query Language filter stage that narrows down the displayed results.
Syntax
filter <boolean expr>Description
The filter stage identifies which data records should be returned by the query. Filters are boolean expressions that can use a wide range of functions and operators to express the filter. If a record matches the filter as the filter expression returns true when applied to the record, the record is returned in the query's result set.
The functions you can use with a filter are described in Functions. For a list of supported operators, see Supported Operators.
Examples
Return xdr_data records where the event_type is NETWORK and the event_sub_type is NETWORK_HTTP_HEADER.
dataset = xdr_data | filter event_type = NETWORK and event_sub_type = NETWORK_HTTP_HEADER
Note
When entering filters to the XQL Search user interface, possible field values for fields of type enum are available using the auto-complete feature. However, the autocomplete can only show enum values that are known to the schema. In some cases, on data import an enum value is included that is not known to the defined schema. In this case, the value will appear in the result set as an unknown value, such as event_type_unknown_4. Be aware that even though this value appears in the result set, you cannot create a filter using it. For example, this query will fail, even if you know the value appears in your result set:
dataset = xdr_data | filter event_type = event_type_unknown_4
When using fields of type enum, the following syntax is supported.
Syntax format A
| filter event_type = ENUM.FILE
Syntax format B
| filter event_type = FILE