Which are the time criteria in AQL queries?

Question

Options

• ASTART, BETWEEN, LAST, NOW, PARSEDATETIME
• BSTART, STOP, BETWEEN, LAST
• CSTART, STOP, LAST, NOW, PARSEDATETIME
• DSTART, STOP, BETWEEN, FIRST

• A
  3% (1)
• B
  5% (2)
• C
  78% (29)
• D
  14% (5)

Explanation

Option C correctly identifies all five time criteria in AQL (Ariel Query Language, used in IBM QRadar): START and STOP define an absolute time range's boundaries, LAST specifies a relative duration (e.g., LAST 24 HOURS), NOW represents the current timestamp, and PARSEDATETIME converts a formatted date string into a usable time value.

Why the distractors fail:

• A swaps STOP for BETWEEN - BETWEEN is not an AQL time criterion; it's a comparison operator used in other SQL-like contexts.
• B omits NOW and PARSEDATETIME, giving only four criteria instead of five.
• D replaces NOW and PARSEDATETIME with FIRST, which is not an AQL time criterion at all.

Memory tip: Think of a timeline story - you START, you STOP, you look at what happened LAST, you check NOW, and if a date is in an unusual format you PARSEDATETIME it. The key discriminator is that STOP (not BETWEEN) closes the time window, and both NOW and PARSEDATETIME are needed for the full five.

No community discussion yet for this question.