xql_get_query_results_stream
Retrieve XQL query results exceeding 1000 records via streaming, ensuring complete data from initiated XQL queries.
Instructions
Get XQL query results Stream
Retrieve XQL query results with more than 1000 results.
Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.
Response is returned as chunked (Transfer-Encoding: chunked). To retrieve a compressed gzipped response (Content-Encoding: gzip), in your header add Accept-Encoding: gzip.
For more information on how to run XQL queries, see Running XQL query APIs.
Note
To ensure you don't surpass your quota, Cortex XSIAM allows you to run up to four API queries in parallel.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/xql/get_query_results_stream] · XQL query
Example request body:
{
"request_data": {
"stream_id": "563c5e24-===-9a1f8139d3c5",
"is_gzip_compressed": true
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes |