Administration Guide › Queries and Reports › How to Create a Query › How to Set Result Conditions

How to Set Result Conditions

You can set a date range and other result conditions for the query, including row limits and base display time period. You can change result conditions at any time, making them a useful way to modify queries without altering the base query or its filters.

If you are creating a scheduled report or action alert, you can set result conditions for both event and incident queries that make up the jobs.

You can set the following types of result conditions:

• Date range conditions governing the query search period.
• Display conditions, such as maximum rows. You can use a limited subset of the display conditions with custom ODBC queries.
• Grouped Event conditions, such as the most recent grouped events after a given date, or grouped events containing a set number of events. Grouped Event conditions are not available for custom ODBC queries.

  Note: If you do not group at least one column when creating a query, users are unable to edit result conditions from the query display.

More information:

How to Create a Query

Set a Time or Date Range

Set Display and Group Conditions