Dashboards & Visualizations

Dashboard Saved search results is being truncated to 1000

alexantao
Path Finder

I built a Saved Search and configured a Dashboard to include that Saved Search (below). In a panel of this Dashboard, I configured a report based on this saved search.

When I load the Dashboard, the search is started and stops showing NO data and a message below the graphic said that the results were truncated, and No data is shown. Opening in search I get a lot of results in events....

The Saved Search:

index=acess_web |eval Gb=bytes_in/1073741824| timechart span=1d sum(Gb) 

Screenshot:

imageshack.com/a/img571/9028/ddaw.png

Thanks for any help

kbecker
Communicator

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this.

Thanks,
Ken

0 Karma

the_wolverine
Champion

I'm encountering the same issue using PDF report. The view (dashboard) displays all the results just fine. A manual preview generates a PDF that displays only 1000 lines when there should be many more lines. This started after our upgrade to 5.0.3 (from version 4.3.x).

alexantao
Path Finder

Tried to put earliest=-mon on search string but didn't work (same results).
The strange is that, when I try the search mannually, on the result table for 1 second apears a bunh of rows with all dates and then disapear, showing only the results (correct results) from the search.

0 Karma

alexantao
Path Finder

Update: after the saved search ran on background (programed to run at midnight), it stopped working again, for all users.
With the user I created the dashboard, entered the Edit Panel and then, the Statistics mode. It is listing dates since January. There are more than 500 pages of data.
But it should not happen, since I configured to count the events from only 1 month ago ( -1mon, now).

0 Karma

alexantao
Path Finder

Somesoni2, for now, I'm getting 20 rows. But the maximum I'm planning is for the role month, or 31 rows.

0 Karma

alexantao
Path Finder

MuS,
I created a new Dashboard and added the search. It worked ! So I made the new Dashboard similar to the other that doesn't work.

With my user I can see the chart, but with another user, when loading message reaches 71%, the process is aborted and the same message is shown. All other charts are processes.

Chart working: http://imageshack.com/a/img824/2297/uslk.png

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How many rows are you getting while running this query in search app? In ideal situation, if your selected timerange (in both search app and in your dashboard) should be set to show one month data. If nothing is specified if will run for All Times and may result more than 30 rows.

0 Karma

MuS
SplunkTrust
SplunkTrust

if you run this search in the search app:

index=acess_web |eval Gb=bytes_in/1073741824| timechart span=1d sum(Gb)

do you get back any results? Do you have any field named 'bytes_in'?

0 Karma

alexantao
Path Finder

The Visualisation must show 1 month of logs, with 1 day of span. In teory, the visualisation should have only 30 points, each one is one day, and the data is the sum of Gb transfered that day.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is the earliest and latest value for the dashboard?

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...