Useful XQL user interface features

Query Builder features help you to create and refine XQL queries in Cortex XSIAM.

The user interface contains several useful features for querying data and viewing results:

• XQL query: Define your query parameters. The field provides suggestions and definitions as you type.

  Dataset schema changes can take time to appear in autocomplete suggestions.

  Tip

  When creating XQL queries, you can:

  • Use the arrow keys to navigate suggestions and definitions.
  • Press Enter or Tab to select a suggestion.
  • Press Shift+Enter for a new line, or Esc to close suggestions.
• Translate to XQL: Converts Splunk queries to XQL syntax. Enable this option to display SPL query and XQL query fields.
• Query Results: View, filter, and visualize results after you run a query.
• XQL Helper: Describes common stage commands and provides examples.
• Query Library: Contains predefined queries. You can save, manage, and share personal queries. For more information, see Manage your personal query library.
• Schema: Lists each result-set field, its data type, descriptive text, and dataset.

  • For dataset queries, it lists fields from every involved dataset.
  • For data model queries, it lists data model fields.