Prisma Cloud: RQL results limited only to 100K

Prisma Cloud: RQL results limited only to 100K

353
Created On 08/28/23 06:54 AM - Last Modified 12/17/25 03:07 AM


Symptom


  • The Investigate Page returned incorrect number with cap around 100K. For example:
    The total count should be 790K
    image-20230821-095700.png
    The RQL only returned 99K
    Untitled.png
     
 


Environment


  • Prisma Cloud
  • Investigate page
  • RQL 


Cause


When Prisma Cloud searching with RQL, it automatically applied a cap=100K, to ensure performance.

Screenshot 2023-08-28 at 2.52.04 PM.png
 


Resolution


There are 2 ways to address this issue.

  1. Open a ticket with Support. This limit can be increased from the backend.
  2. Alternatively, to get correct total number, Write an API: https://pan.dev/prisma-cloud/api/cspm/search-config/ with higher "limit".


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000g26xCAA&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail