Query Limit on a UI view?

jgauthier — Mon, 13 Jun 2011 18:12:26 GMT

I've built a very small example to reproduce a problem I am having. Using this page as an example:
http://www.splunk.com/base/Documentation/4.2.1/Developer/FormSearchPostProcess

I've built a dashboard that looks like this:

Requests search

  <searchTemplate>sourcetype="Exchange2010" sender="$sender$"</searchTemplate>

  <fieldset>
    <input type="text" token="sender">
      <label>Sender</label>
      <seed>*</seed>
    </input>

    <input type="time">
    <default>Last 30 days</default>
    </input>
  </fieldset>

  <row>
    <chart>
      <title>Requests over time for result set</title>
      <searchPostProcess>timechart count as "Requests"</searchPostProcess>
      <option name="charting.chart">column</option>
    </chart>
  </row>

  <row>
    <chart>
      <title>Top users in result set</title>
      <searchPostProcess>top 10 recipient</searchPostProcess>
      <option name="charting.chart">pie</option>
    </chart>

  </row>

  <row>
    <table>
      <title>Requests in result set</title>
      <searchPostProcess>sort - _time | fields _time, sender, recipient</searchPostProcess>
      <fields>_time, sender, recipient</fields>
      <option name="showPager">true</option>
      <option name="count">30</option>
      <option name="displayRowNumbers">false</option>
      </table>
  </row>
</form>

Regardless of the "Time" chosen, the query seems to abort just after hitting 10,000 rows.
Is this a known limitation? Is there a configuration change I can make to get more?
In some instances, this is only good for a day or two of data, and after that short data. for instance, I can select 30 days, but I really only get about 6.

It always seems to stop short. I'm not sure why, but I never get more than 13,000 records.

Thanks!

Re: Query Limit on a UI view?

melting — Mon, 13 Jun 2011 22:49:09 GMT

Post process is limited to 10,000 events. If you want the full amount you can split into unique searches.

Some values are configurable in limits.conf

Re: Query Limit on a UI view?

jgauthier — Tue, 14 Jun 2011 12:44:04 GMT

I'm not sure I understand "split into unique searches." and how it applies to this. Could you elaborate?

Re: Query Limit on a UI view?

swdonline — Mon, 30 Jan 2012 13:42:02 GMT

@jgauthier - He's saying instead of doing a single searchTemplate and then searchPostProcess for each chart, get rid of searchPostProcess and do a searchTemplate within each chart. It means you're going to run more searches, but ultimately will be able to surpass the 10,000 event limit.

topic Re: Query Limit on a UI view? in Dashboards & Visualizations

Query Limit on a UI view?

Re: Query Limit on a UI view?

Re: Query Limit on a UI view?

Re: Query Limit on a UI view?