limit

Learn more about the Cortex Query Language limit stage that sets the maximum number of records that can be returned in the result set.

Syntax

limit <number>

Description

The limit stage sets the maximum number of records that can be returned in the result set. If this stage is not specified in the query, 1,000,000 is used.

Using a small limit can greatly increase the performance of your query by reducing the number of records that Cortex XDR can return in the result set.

Examples

Set the maximum number of records returned by the query to 10.

dataset = xdr_data | limit 10