EBL size limit - sorting output feed

dhenke — Wed, 14 Nov 2018 20:59:13 GMT

I'm using a minemeld server to generate an external dynamic list for a PA-5220 runing version 8.1.4. The dynamic URL list exceeds the 50,000 entry limit.

I've seen other posts recommending to use URL parameters to limit the list to the first 50,000 and that the list is sorted by age by default. (see https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Confused-over-EBL-size-limit/td-p/104038)

The URL parameters work fine, but in my experience, the output list is sorted by alpha-numeric/name, not age. The article at https://live.paloaltonetworks.com/t5/MineMeld-Articles/Parameters-for-the-output-feeds/ta-p/146170 under the "Additional parameters" section shows how the default format sorting is by name rather than date.

I'm using the built-in stdlib.feedHCGreen prototype.

Do I need to create a custom prototype that will sort by age rather than name?

Re: EBL size limit - sorting output feed

lmori — Tue, 20 Nov 2018 13:50:18 GMT

Hi @dhenke,

no, the default is by last update. It could be that you see the entries ordered in alphabetical order because the original list was listing them in alphabetical order. The original order will be reflected in the output feed only in some subsets. But the entry 0 will always be the most recent entry, and so on..

topic Re: EBL size limit - sorting output feed in General Topics

EBL size limit - sorting output feed

Re: EBL size limit - sorting output feed