In this article, administrators can understand how to set the number of rows of data displayed in a search or set a default search result limit for the Log Activity or Network Activity tab.
- For a saved search, the limit is stored in the saved search and reapplied when search is loaded.
- When you are sorting a column in the search result that has a row limit, sorting is done within the limited rows, which are shown in the data grid.
- For a grouped by search where time series chart is turned on, the row limit applies only to the data grid. The Top N list in the time series chart controls how many time series are drawn in the chart.
Note: The Result Limit field exists as an Advanced Search (AQL) operator named LIMIT. If you run an advanced search and want to call a limit in your results, it must be defined before the start time in your query.
SELECT * FROM events LIMIT 100 START '2021-10-28 10:00' STOP '2021-10-28 11:00'
- Log in to QRadar as an administrator.
- Click the Admin tab.
- Click the System Settings icon.
- From the Console Settings section, configure the following values:
- Result Per Page - Sets the default number of rows displayed per page in the user interface.
- Default Search Limit - Sets the default limit for any search.
Figure 1: System settings can be configured to set the page view limits or search limit for all users globally.
- From the Admin tab, click Deploy Changes.
After the system deploys the changes to all hosts, run a search to configure the new limitations or rows displayed in the Log Activity or Network Activity tab.
Was this topic helpful?
28 February 2022