EDR: Process Analysis Export Results are Missing Events
search cancel

EDR: Process Analysis Export Results are Missing Events

book

Article ID: 287661

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Exported events are less than the events viewed on the Process Analysis page.

Environment

EDR Server:  7.6.x

Cause

When exporting events within the process analysis page, results can be incomplete for very long running processes (for what is currently stored in Solr on disk)

Resolution

The current workaround is to pull the raw data from solr via the command line.  

Additional Information

  • Prior to Exporting events, confirm the Process Analysis timeline is fully extended.