Error "The response data count (X) exceeds the maximum data count allowed (10,000). Narrow your search criteria." when exporting System Events to CSV

Products

• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

When attempting to export System Events using the Export All: CSV option, the system generates the following error message:

"The response data count (X) exceeds the maximum data count allowed (10,000). Narrow your search criteria."

X corresponds to the total number of events currently matching your report filters.

Environment

Symantec Data Loss Prevention (DLP) 25.1 or higher

Cause

In DLP 25.1 and newer, the number of System Events that can be exported in a single batch is limited to 10,000 by default to optimize system performance.

Resolution

The limit can be increased by modifying the Enforce Server configuration. Setting this value significantly higher may negatively impact the load speed of the System Events report. If you experience performance issues after making this change, we recommend lowering the limit.

To change the limit:

1. On the Enforce server, locate the Enforce.properties file. By default it's located in \Program Files\Symantec\DataLossPrevention\EnforceServer\25.1.00000\Protect\config
2. Open the file in a text editor and locate the following line:
   com.vontu.manager.restapi.systemEventList.max_page_size = 10000
   
3. Adjust the value of the property to the desired value and save the file.
4. Attempt to export the events once more. The new limit will now be applied.

Note: This configuration change takes effect immediately. No service restarts are required.