Dashboards & Visualizations

Post Process Dashboard panel showing "search generated too much data for the current display configuration, results have been truncated"

rameshnani
New Member

Hello,

I need help on post process,

Here are my queries:

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="*" | timechart span=1d count by OPERATION

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)

I updated my dashboard and I used the post process

Here is my base query:
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | fields *

Sub Queries:

  1. |timechart span=1d count by OPERATION
  2. |search OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)
  3. |search OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)
  4. |search OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)

All dashboard panels are working are working fine except 1st one. In the dashboard 1st panel I'm seeing results but there is a warning message saying that "search generated too much data for the current display configuration, results have been truncated."

How to fix this issue? Can I send limited COUNT and AVG data to subqueries(1st panel)?

Tags (1)
0 Karma

kbecker
Communicator

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this.

Thanks,
Ken

0 Karma

sundareshr
Legend

Main searches in postprocess dashboard, has a limit of 500K events returned. It is advisable to limit by using a transforming command in the main search. Try something like this...

*Main Search*

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | bin span=30m _time | stats count sum(OPERATION) by _time OPERATION

*Sub Search 1*

| timechart span=1d sum(count) as count by OPERATION limit=0

*Sub Search 2*

|search OPERATION="XXXXXX" | fields - OPERATION - count

and so on...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...