topic Timechart with large split by gives" Your search generated too much data for the current visualization configuration." Is it truncating stats or chart or both? in Splunk Search

Timechart with large split by gives" Your search generated too much data for the current visualization configuration." Is it truncating stats or chart or both?

mikelanghorst — Tue, 13 May 2014 22:26:01 GMT

When running a search against a weblog, and attempting to "|timechart span=1h limit=0 count by queryname" for 24hrs, I get the " Your search generated too much data for the current visualization configuration."

Is it just truncating the graph, or the statistics table as well?

Re: Timechart with large split by gives" Your search generated too much data for the current visualization configuration." Is it truncating stats or chart or both?

MuS — Wed, 14 May 2014 06:50:01 GMT

Hi mikelanghorst,

according to the docs this message is from the JSChart Module and related to the object rendering limit in the chart library.

running this test search on my development box

index=_internal | timechart span=10sec count

returns about 4700 events in the statistic table but brings the message

These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached.

on the report graph.
So from my understanding this message is completely related to the chart and not effects the statistic table.

hope this helps ...

cheers, MuS

Re: Timechart with large split by gives" Your search generated too much data for the current visualization configuration." Is it truncating stats or chart or both?

kbecker — Thu, 15 Sep 2016 17:34:25 GMT

Have you opened a case with Splunk for this? This is a hard limit which we have an enhancement request ticket open, more customers requesting this to be raised should push Splunk to fix this.