Administration Guide › Queries and Reports › How to Create a Query › How to Set Result Conditions

How to Set Result Conditions

You can set a date range and other result conditions for the query, including row limits and base display time period. Result conditions can be altered at any time up to the query's run time, making them a useful way to modify queries without altering the base query or its filters.

If you are creating a scheduled report job or action alert job, you can set result conditions for both event and incident queries that make up the job as needed.

You can set the following types of result conditions:

• Date range conditions governing the query's search period
• Display conditions, such as maximum rows
• Grouped Event conditions, such as the most recent grouped events after a given date, or grouped events containing a set number of events.

  Note: If you do not group at least one column when creating a query, users will not be able to edit result conditions from the query display.

More information:

Set a Time or Date Range

Set Display and Group Conditions