Custom Report May Not Show All Data Depending on Columns Selected

Custom Report May Not Show All Data Depending on Columns Selected

16391
Created On 09/26/18 13:54 PM - Last Modified 06/01/23 02:53 AM


Resolution


Issue

When performing a log query, if there are more than 100K entries that can match the query, the query will stop when this limit is reached.

 

The 100K limit is the current limit in report generation. The report generation performs the query in the 'backward" direction (search from the latest to the oldest log entry until hitting the 100K limit), therefore the newer dates are present but not the older dates. Depending on what columns are selected, adding certain columns may result in more matching individual entries. In most cases, the 100K limit is unlikely to be met. There are currently no plans to increase the limit.

 

Workaround

Separate the query into shorter time periods to avoid hitting this limit and combine the results.

 

owner: ttan



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClznCAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language