Abstract
Learn more about the Cortex Query Language limit stage that sets the maximum number of records that can be returned in the result set.
Syntax
limit <number>Description
The limit stage sets the maximum number of records that can be returned in the result set. If this stage is not specified in the query, 1,000,000 is used.
Using a small limit can greatly increase the performance of your query by reducing the number of records that Cortex XDR can return in the result set.
Examples
Set the maximum number of records returned by the query to 10.
dataset = xdr_data | limit 10