Technical Tip: Only 10,000 rows displayed in the FortiAnalyzer report table
Description
This article describes how to set the maximum number of rows in a FortiAnalyzer report table to 100,000. The default number of rows for a chart of type table is limited to 10,000 rows only by design. Hence, any table exceeding this limit would not display the logs beyond 10,000 rows.
Scope
FortiAnalyzer.
Solution
The report rows limit in FortiAnalyzer is 100,000 rows. Set this limit under the report settings using the following commands:
config system report setting
set max-table-rows 100000 --> Maximum number of rows that can be generated in a single table (Input integer value (10000-10000000)).
end
set max-table-rows 100000 --> Maximum number of rows that can be generated in a single table (Input integer value (10000-10000000)).
end
After setting the limit on the CLI, also set the limit in the chart in the data binding section.
It should be noted that by setting the limit to 100,000, there may be a significant impact on the time taken for report generation. This will apply particularly on low-end devices like the FortiAnalyzer-200F, where a large latency will be experienced while generating the report with 10,000+ records.
Related document:
FortiAnalyzer CLI Reference Guide: report_setting.