topic Re: Search generated too much data... in Splunk Search

Search generated too much data...

terryloar — Mon, 23 Apr 2012 22:51:25 GMT

Has anyone run into this message?

"Search generated too much data for the current display configuration, results have been truncated"

The search is for collecting and grouping latency times (spent).

source="/opt/splunk/var/log/splunk/web_access.log"

| eval dum=case(spent==0, spent)
| eval 0-99(ms)=case(spent>=0 AND spent<=99, spent)
| eval 100-199(ms)=case(spent>=100 AND spent<=199, spent)
| eval 200-299(ms)=case(spent>=200 AND spent<=299, spent)
| eval 300-399(ms)=case(spent>=300 AND spent<=399, spent)
| eval 400-499(ms)=case(spent>=400 AND spent<=499, spent)
| eval over500(ms)=case(spent>=500, spent)
| table spent 0-99(ms) 100-199(ms) 200-299(ms) 300-399(ms) 400-499(ms) over500(ms)

Re: Search generated too much data...

uuppuluri_splun — Mon, 28 Sep 2020 15:31:27 GMT

For simple XML, in 5.0.3.1 and above, you can set the config as below in $SPLUNK_HOME/etc/system/local/web.conf
[settings]
simple_xml_force_flash_charting = true

For Advanced XML, change

layoutPanel="graphArea"> in
etc/apps/search/default/data/ui/views/charting.xml to
FlashChart.

Hope This Helps!

Re: Search generated too much data...

kbecker — Thu, 29 Sep 2016 15:09:45 GMT

Have you opened a support ticket with Splunk, we are trying to get them to remove these limits and more customers will help drive this.

Re: Search generated too much data...

davidpaper — Thu, 29 Sep 2016 15:26:02 GMT

Hi,

I 6.x and above, you can alter the max number of data points in a series for a timechart in a dashboard and stay w/in the HTML5 realm and not need to invoke Flash.

< option name="charting.data.count" >9999 </ option >

to get around the 1000 point limitation in timechart.

Re: Search generated too much data...

kbecker — Thu, 29 Sep 2016 15:31:15 GMT

This does increase the value but there is still an upper limit that is hard coded