Limit

Cortex XDR XQL sort stage sets the maximum number of records that can be returned in the result set.

Synopsis

limit <
n
>

Description

The
limit
stage sets the maximum number of records that can be returned in the result set. If this stage is not specified on the query, 1,000,000 is used.
Using a small limit can greatly increase the performance of your query by reducing the number of records that Cortex XDR can return in the result set.

Examples

Set the maximum number of records returned by the query to 10.
dataset = xdr_data | limit 10

Recommended For You