Technical Tip: FortiSIEM Report and Query Event Limits

This article describes that when generating queries or reports, there are a few limits on the number of events that can be written out.

Scope

FortiSIEM.

Solution

This is a summarized list of the limits:

Queries (Historical Searches).

• 10,000 Lines/Events.

- If there are defined any Group By/Aggregate Conditions.

• 100,000 Lines/Events.

- Undefined any Group By/Aggregate Conditions.

Reports - With Export.

• 2,000 Lines/Events When:

- Results include the Raw Event Log attribute regardless of export to PDF or CSV.

• 10,000 Lines/Events When:

- Results do NOT include the Raw Event Log attribute.

- When defining any Group By/Aggregate Conditions (regardless of export to PDF or CSV)

• 50,000 Lines/Events When:

- Results do NOT include the Raw Event Log attribute AND

- When undefining any Group By/Aggregate Conditions AND

- To export to PDF

• 100,000 Lines When:

- Results do NOT include the Raw Event Log attribute AND

- When undefining any Group By/Aggregate Conditions AND

- To export to CSV

When the actual query or report result set is larger than the limits specified above, the results will be truncated based on these values.

Additional Information

Version 3.7.5 and earlier contain two GUI bugs that misstate the limits.

The bugs to resolve are:

1. 9956: Export Report dialog box incorrectly says the PDF output is limited to 5,000 lines
2. 9957: Report RUN NOW dialog box incorrectly says the report output is limited to 100,000 lines

Version Affected

v3.7.5 and Below