<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Is Anyone Experiencing the 1,000 Entry Limit When Exporting Issues? in Cortex XDR Discussions</title>
    <link>https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/is-anyone-experiencing-the-1-000-entry-limit-when-exporting/m-p/1251339#M9227</link>
    <description>&lt;P&gt;Since upgrading to Cortex 5.0, exporting an Excel file via the &lt;STRONG data-end="73" data-start="63"&gt;Export&lt;/STRONG&gt; button in the &lt;STRONG data-end="98" data-start="88"&gt;Issues&lt;/STRONG&gt; menu only retrieves up to 1,000 entries. Is anyone else experiencing the same issue? It’s quite inconvenient—if there’s a way to resolve it, please let me know.&lt;/P&gt;</description>
    <pubDate>Wed, 01 Apr 2026 07:53:43 GMT</pubDate>
    <dc:creator>.522643</dc:creator>
    <dc:date>2026-04-01T07:53:43Z</dc:date>
    <item>
      <title>Is Anyone Experiencing the 1,000 Entry Limit When Exporting Issues?</title>
      <link>https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/is-anyone-experiencing-the-1-000-entry-limit-when-exporting/m-p/1251339#M9227</link>
      <description>&lt;P&gt;Since upgrading to Cortex 5.0, exporting an Excel file via the &lt;STRONG data-end="73" data-start="63"&gt;Export&lt;/STRONG&gt; button in the &lt;STRONG data-end="98" data-start="88"&gt;Issues&lt;/STRONG&gt; menu only retrieves up to 1,000 entries. Is anyone else experiencing the same issue? It’s quite inconvenient—if there’s a way to resolve it, please let me know.&lt;/P&gt;</description>
      <pubDate>Wed, 01 Apr 2026 07:53:43 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/is-anyone-experiencing-the-1-000-entry-limit-when-exporting/m-p/1251339#M9227</guid>
      <dc:creator>.522643</dc:creator>
      <dc:date>2026-04-01T07:53:43Z</dc:date>
    </item>
    <item>
      <title>Re: Is Anyone Experiencing the 1,000 Entry Limit When Exporting Issues?</title>
      <link>https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/is-anyone-experiencing-the-1-000-entry-limit-when-exporting/m-p/1251357#M9230</link>
      <description>&lt;P&gt;Hello&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/645079201"&gt;@.522643&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Greetings for the day.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P data-end="202" data-start="0"&gt;Yes, this is a known behavior and identified issue in Cortex XDR 5.0. Several users and support cases have reported that exporting data from the Issues (formerly Alerts) menu is capped at 1,000 records.&lt;/P&gt;
&lt;H4 data-end="230" data-start="204" data-section-id="1klt5yt"&gt;Reason for the Limit:&lt;/H4&gt;
&lt;P data-end="482" data-start="231"&gt;The 1,000-record export limit was introduced in version 5.0 as a hardcoded performance safety measure to ensure management console stability and UI responsiveness. This issue is currently being tracked by engineering.&lt;/P&gt;
&lt;H4 data-end="518" data-start="489" data-section-id="y6tg3m"&gt;Recommended Workarounds:&lt;/H4&gt;
&lt;P data-end="655" data-start="520"&gt;Until a permanent fix or adjustment to the UI limit is released, you can use the following methods to retrieve more than 1,000 entries:&lt;/P&gt;
&lt;H4 data-end="696" data-start="657"&gt;1. Use XQL Search (Query Center)&lt;/H4&gt;
&lt;P data-end="811" data-start="697"&gt;The most effective way to export large datasets (up to 50,000 or more rows) is through the Query Center using XQL.&lt;/P&gt;
&lt;UL data-end="924" data-start="813"&gt;
&lt;LI data-end="859" data-start="813" data-section-id="493rv1"&gt;Navigate to &lt;STRONG data-end="857" data-start="827"&gt;Investigation → XQL Search&lt;/STRONG&gt;&lt;/LI&gt;
&lt;LI data-end="924" data-start="860" data-section-id="ukjwx7"&gt;Run a query against the alerts or issues dataset. For example:&lt;/LI&gt;
&lt;/UL&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;DIV class="relative w-full mt-4 mb-1"&gt;
&lt;DIV class=""&gt;
&lt;DIV class="relative"&gt;
&lt;DIV class="h-full min-h-0 min-w-0"&gt;
&lt;DIV class="h-full min-h-0 min-w-0"&gt;
&lt;DIV class="border border-token-border-light border-radius-3xl corner-superellipse/1.1 rounded-3xl"&gt;
&lt;DIV class="h-full w-full border-radius-3xl bg-token-bg-elevated-secondary corner-superellipse/1.1 overflow-clip rounded-3xl lxnfua_clipPathFallback"&gt;
&lt;DIV class="w-full overflow-x-hidden overflow-y-auto pe-11 pt-3"&gt;
&lt;DIV class="relative z-0 flex max-w-full"&gt;
&lt;DIV id="code-block-viewer" class="q9tKkq_viewer cm-editor z-10 light:cm-light dark:cm-light flex h-full w-full flex-col items-stretch ͼ5 ͼj" dir="ltr"&gt;
&lt;DIV class="cm-scroller"&gt;
&lt;DIV class="cm-content q9tKkq_readonly"&gt;&lt;SPAN&gt;dataset = alerts&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;DIV class="cm-content q9tKkq_readonly"&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;H4 data-end="1158" data-start="1119"&gt;2. Segmented Exports (Filtering)&lt;/H4&gt;
&lt;P data-end="1355" data-start="1159"&gt;If you prefer using the Issues menu directly, narrow down your results using stricter filters (such as specific time ranges or severity levels) so that each export contains fewer than 1,000 items.&lt;/P&gt;
&lt;H4 data-end="1400" data-start="1362"&gt;&amp;nbsp;&lt;/H4&gt;
&lt;H4 data-end="1400" data-start="1362"&gt;3. Manual Copy (Small Datasets)&lt;/H4&gt;
&lt;P data-is-only-node="" data-is-last-node="" data-end="1644" data-start="1401"&gt;For smaller datasets slightly over the limit, you can select rows in the table, right-click, and choose &lt;STRONG data-end="1525" data-start="1505"&gt;Copy entire rows&lt;/STRONG&gt;, then paste the data into Excel. Note that this is still limited by the number of records loaded in your browser view.&lt;/P&gt;
&lt;P data-is-only-node="" data-is-last-node="" data-end="1644" data-start="1401"&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;If you feel this has answered&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN class="il"&gt;your&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;query, please let us know by clicking &lt;STRONG&gt;like &lt;/STRONG&gt;and on&lt;STRONG&gt; "mark this as a Solution".&lt;/STRONG&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;
&lt;P&gt;Thanks &amp;amp; Regards,&lt;BR /&gt;S. Subashkar Sekar&lt;/P&gt;</description>
      <pubDate>Wed, 01 Apr 2026 15:09:38 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/is-anyone-experiencing-the-1-000-entry-limit-when-exporting/m-p/1251357#M9230</guid>
      <dc:creator>susekar</dc:creator>
      <dc:date>2026-04-01T15:09:38Z</dc:date>
    </item>
  </channel>
</rss>

