IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  AQL query question

    Posted 05/06/21 05:13 AM

    Hello everyone, I would like to know how to add a column that calculate the total sum of all the rows in all of the aggregates.

    Here is the output I have:

    https://preview.redd.it/xlomkpev4bx61.png?width=1885&format=png&auto=webp&s=6c7c397426fc41d9c3976f0cb69ab659ff8b1582

    I would like to take the event count of each row in the output under Count or Total_count, and add all of them together (298 + 211 + 178 + 178 + 175 etc until the end). Is this possible?

    The query I have right now is this

    SELECT QIDNAME(qid) AS 'Event Name', "sourceIP" AS 'Source IP', SUM("eventCount") AS 'Event Count (Sum)', MIN("startTime") AS 'Start Time (Minimum)', COUNT(*) AS 'Count' , sum(eventcount) as 'Total_count' from events where ( "deviceGroupList"='101350' AND "processorId"='229' ) GROUP BY qid, "sourceIP" order by "Count" last 5 minutes

    Thank you in advance.



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: AQL query question

    Posted 05/25/21 04:38 PM

    This is likely something that you can do with an AQL Custom Function. As you can do things like aggregate values and do math on fields. Take a look at this information: https://www.ibm.com/docs/en/qradar-common?topic=1-custom-aql-functions



    #QRadar
    #Support
    #SupportMigration


Related Content