000035921 - Not seeing all results when testing a rule in the Reporting Engine of RSA NetWitness

Document created by RSA Customer Support Employee on Jan 25, 2018
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000035921
Applies ToRSA Product Set:- RSA Security Analytics
RSA Product/Service Type:- RSA Security Analytics Reporting Engine
RSA Version/Condition: 10.6.4
 
IssueNot all Test Rule result values are displayed when there are more than 50,000 values that should be returned.
ResolutionThis is a defined behavior of testing a rule in the Reporting Engine on Netwitness. The maximum limit for the Test Rule is 50,000. 

In case you want to see more values, the correct approach would be to include the rule in a Report and run the report for the desired time range.

Attachments

    Outcomes