EDR: Unpaged request has "x" results, exceeds limit of 1000. Please consider using paging.
search cancel

EDR: Unpaged request has "x" results, exceeds limit of 1000. Please consider using paging.

book

Article ID: 284947

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

  • When attempting to use the API to query greater than 1000 sensors an error is encountered.  These errors can be encountered via the UI, RestAPI and Python API.
  • Some users have reported seeing this message while using the Python API:
'{"message":"Unpaged request has <num> results, exceeds limit of 1000. Please consider using paging."}'

 

Environment

  • EDR: 7.6.0 +

Cause

  • CB-36843 which was remedied in EDR 7.6.0 included a defect fix that implemented a new parameter into the /etc/cb/cb.conf file:
  • By default this is set to '1000'.  Previously it was non-existent.

Resolution

  • For CBAPI:
    • Please upgrade to cbapi 1.7.6 to take advantage of the pagination. No adjustments needed to your script as cbapi will do the pagination. All Products: How to Update CbAPI
  • For Console export:
    • Add the following settings to a value higher than is returned by the unpaged request
      SensorUnpagedFetchLimit=
    • Restart coreservices (primary only for clustered)
      /usr/share/cb/cbservice cb-coreservices restart