topic Re: Post Process Dashboard panel showing "search generated too much data for the current display configuration, results have been truncated" in Dashboards & Visualizations

Post Process Dashboard panel showing "search generated too much data for the current display configuration, results have been truncated"

rameshnani — Tue, 29 Sep 2020 10:46:11 GMT

Hello,

I need help on post process,

Here are my queries:

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="*" | timechart span=1d count by OPERATION

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)

I updated my dashboard and I used the post process

Here is my base query:
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | fields *

Sub Queries:

|timechart span=1d count by OPERATION
|search OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)
|search OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)
|search OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)

All dashboard panels are working are working fine except 1st one. In the dashboard 1st panel I'm seeing results but there is a warning message saying that "search generated too much data for the current display configuration, results have been truncated."

How to fix this issue? Can I send limited COUNT and AVG data to subqueries(1st panel)?

Re: Post Process Dashboard panel showing "search generated too much data for the current display configuration, results have been truncated"

sundareshr — Fri, 26 Aug 2016 20:50:44 GMT

Main searches in postprocess dashboard, has a limit of 500K events returned. It is advisable to limit by using a transforming command in the main search. Try something like this...

*Main Search*

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | bin span=30m _time | stats count sum(OPERATION) by _time OPERATION

*Sub Search 1*

| timechart span=1d sum(count) as count by OPERATION limit=0

*Sub Search 2*

|search OPERATION="XXXXXX" | fields - OPERATION - count

and so on...

Re: Post Process Dashboard panel showing "search generated too much data for the current display configuration, results have been truncated"

kbecker — Thu, 29 Sep 2016 15:10:53 GMT

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this.

Thanks,
Ken