original_docstring: 
      Creates a search to retrieve events for an offense.
      Has retry mechanism, because QRadar service tends to return random errors when
      it is loaded.
      Therefore, 'max_retries' retries will be made, to try avoid such cases as much as possible.
      Args:
          client (Client): Client to perform the API calls.
          fetch_mode (str): Which enrichment mode was requested.
                            Can be 'Fetch With All Events', 'Fetch Correlation Events Only'
          offense (Dict): Offense ID to enrich with events.
          event_columns (str): Columns of the events to be extracted from query.
          events_limit (int): Maximum number of events to enrich the offense.
          max_retries (int): Number of retries.
  
  
      Returns:
          (Dict): If search was created successfully.
          None: If reset was triggered or number of retries exceeded limit.
      
docstring: Creates a search to retrieve events for an offense.
  Has retry mechanism, because QRadar service tends to return random errors when
  it is loaded.
  Therefore, 'max_retries' retries will be made, to try avoid such cases as much as possible.
docstring_tokens: Creates a search to retrieve events for an offense . Has retry mechanism because QRadar service tends to return random errors when it is loaded . Therefore ' max_retries ' retries will be made to try avoid such cases as much as possible .
code: def create_search_with_retry(client: Client, fetch_mode: str, offense: Dict, event_columns: str, events_limit: int,
                               max_retries: int = EVENTS_FAILURE_LIMIT) -> Optional[Dict]:
      """
      Creates a search to retrieve events for an offense.
      Has retry mechanism, because QRadar service tends to return random errors when
      it is loaded.
      Therefore, 'max_retries' retries will be made, to try avoid such cases as much as possible.
      Args:
          client (Client): Client to perform the API calls.
          fetch_mode (str): Which enrichment mode was requested.
                            Can be 'Fetch With All Events', 'Fetch Correlation Events Only'
          offense (Dict): Offense ID to enrich with events.
          event_columns (str): Columns of the events to be extracted from query.
          events_limit (int): Maximum number of events to enrich the offense.
          max_retries (int): Number of retries.
  
  
      Returns:
          (Dict): If search was created successfully.
          None: If reset was triggered or number of retries exceeded limit.
      """
      additional_where = ''' AND LOGSOURCETYPENAME(devicetype) = 'Custom Rule Engine' ''' \
          if fetch_mode == FetchMode.correlations_events_only.value else ''
      # Decrease 1 minute from start_time to avoid the case where the minute queried of start_time equals end_time.
      offense_start_time = offense['start_time'] - 60 * 1000
      offense_id = offense['id']
      query_expression = (
          f'SELECT {event_columns} FROM events WHERE INOFFENSE({offense_id}) {additional_where} limit {events_limit} '
          f'START {offense_start_time}'
      )
      num_of_failures = 0
      while num_of_failures <= max_retries:
          if is_reset_triggered():
              return None
          try:
              return client.search_create(query_expression=query_expression)
          except Exception as e:
              err = str(e)
              num_of_failures += 1
              if num_of_failures == max_retries:
                  print_debug_msg(f'Unable to create search for offense. Error: {err}')
                  break
              time.sleep(FAILURE_SLEEP)
      return None
code_tokens: def create_search_with_retry ( client : Client , fetch_mode : str , offense : Dict , event_columns : str , events_limit : int , max_retries : int = EVENTS_FAILURE_LIMIT ) -> Optional [ Dict ] : additional_where = ''' AND LOGSOURCETYPENAME(devicetype) = 'Custom Rule Engine' ''' if fetch_mode == FetchMode . correlations_events_only . value else '' offense_start_time = offense [ 'start_time' ] - 60 * 1000 offense_id = offense [ 'id' ] query_expression = ( f'SELECT {event_columns} FROM events WHERE INOFFENSE({offense_id}) {additional_where} limit {events_limit} ' f'START {offense_start_time}' ) num_of_failures = 0 while num_of_failures <= max_retries : if is_reset_triggered ( ) : return None try : return client . search_create ( query_expression = query_expression ) except Exception as e : err = str ( e ) num_of_failures += 1 if num_of_failures == max_retries : print_debug_msg ( f'Unable to create search for offense. Error: {err}' ) break time . sleep ( FAILURE_SLEEP ) return None
short_docstring: Creates a search to retrieve events for an offense.
short_docstring_tokens: Creates a search to retrieve events for an offense .
comment: """
      Creates a search to retrieve events for an offense.
      Has retry mechanism, because QRadar service tends to return random errors when
      it is loaded.
      Therefore, 'max_retries' retries will be made, to try avoid such cases as much as possible.
      Args:
          client (Client): Client to perform the API calls.
          fetch_mode (str): Which enrichment mode was requested.
                            Can be 'Fetch With All Events', 'Fetch Correlation Events Only'
          offense (Dict): Offense ID to enrich with events.
          event_columns (str): Columns of the events to be extracted from query.
          events_limit (int): Maximum number of events to enrich the offense.
          max_retries (int): Number of retries.
  
  
      Returns:
          (Dict): If search was created successfully.
          None: If reset was triggered or number of retries exceeded limit.
      """$SEP$# Decrease 1 minute from start_time to avoid the case where the minute queried of start_time equals end_time.