Qradar expiring whitelist Use AQL filter query username LIKE 'testUser' and LONG(DATEFORMAT(starttime, 'yyyyMMdd')) < 20190429