topic Re: Event annotations getting truncated? in Getting Data In

Event annotations getting truncated?

pkol — Thu, 29 Aug 2019 06:47:13 GMT

Hey guys,
I have been trying to add some event annotations to my line graph but keep getting the following error on the panel:
"[annotation] The results are truncated (1000 of 2379 have been fetched)"

The exact search has been used previously in another panel(not for event annotations) and the data shows up in a different visualisation with no problem.
This is my subsearch which is exactly the same for the "annotation" search.

<search base="transac_base" id="pie">
          <query>| where source=$app_source$
| eval status=if(like(_raw,"%OK%"),"Success",if(like(_raw,"%FAILED%"),"Fail",if(like(_raw,"%already%"),"Running","Timed out/still running")))
|stats count by status</query>

Please HELP!!

Re: Event annotations getting truncated?

woodcock — Sun, 01 Sep 2019 17:46:31 GMT

Show us your base search.

Re: Event annotations getting truncated?

pkol — Sun, 01 Sep 2019 23:28:31 GMT

Hi, this is my base search :

index=synthetic sourcetype=synthetic source = *|fields *|transaction startswith=running by source

Re: Event annotations getting truncated?

cstump_splunk — Tue, 08 Dec 2020 01:26:14 GMT

The limitation is set in visualizations.conf:

[area] data_sources.annotation.params.count = 1000 [column] data_sources.annotation.params.count = 1000 [line] data_sources.annotation.params.count = 1000

Notice there is limit for each chart type that supports annotations. Since you are working with a line graph, you will want raise the limit in the '[line]' stanza.