Vulnerability data download

[CJK]

Hi Team,

Is there any option to downlad more that 10000 raws from vunerability data? From discover and VD inventory page I have tried to export but limited to 10k. And on below opensearch link it says. " CSV reports have a non-configurable 10,000-row limit in OpenSearch version 2.16 and earlier. As of version 2.17, this limit can be configured when setting up a report."
https://docs.opensearch.org/latest/reporting/report-dashboard-index/

Open search version of wazuh 4.14.6 is 2.19.5 so is it possible. I have to download 40k raws. Kindly let me know if any options available.

Thanks & regards

[Stuti Gupta]

Please allow me some time. I'm looking into this.

[Stuti Gupta]

Hi CJK

We are aware of this limit. There are two workarounds that I'm aware of for this situation:

First, use the report:
As a workaround, you need to create a report definition with a record limit of more than 10000,

Firstly, save, then search. For example, in Discover, I have applied a 1-year time-range filter. Then click on Save and give the name report1

Go to Reporting
Then click on Create  under Report definitions
In Report source, select Saved search, now select the search that we saved, like report1
Set the record limit according to your requirement.
Note: Generating reports with a large number of records can cause memory issues
Set the rest of the options accordingly. Once done, click on Create.

After that, you can see your reporting definition in the Reports. From there, you can download the report if you want.
Refer  to https://docs.opensearch.org/latest/reporting/report-dashboard-index/


Second workaround is:
Open this file /usr/share/wazuh-dashboard/plugins/reportsDashboards/server/routes/utils/constants.js

Search for this line
const DEFAULT_MAX_SIZE = exports.DEFAULT_MAX_SIZE = 10000;

Now update this value.
Ex:
const DEFAULT_MAX_SIZE = exports.DEFAULT_MAX_SIZE = 80000;

Restart the Wazuh dashboard
systemctl restart wazuh-dashboard

Let me know if you need more help with this. 

[CJK]

Thanks, Stuti. 

That worked like a charm. I appreciate your quick response!