Dashboards & Visualizations

Post Process Dashboard panel showing "search generated too much data for the current display configuration, results have been truncated"

rameshnani
New Member

Hello,

I need help on post process,

Here are my queries:

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="*" | timechart span=1d count by OPERATION

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)

I updated my dashboard and I used the post process

Here is my base query:
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | fields *

Sub Queries:

  1. |timechart span=1d count by OPERATION
  2. |search OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)
  3. |search OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)
  4. |search OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)

All dashboard panels are working are working fine except 1st one. In the dashboard 1st panel I'm seeing results but there is a warning message saying that "search generated too much data for the current display configuration, results have been truncated."

How to fix this issue? Can I send limited COUNT and AVG data to subqueries(1st panel)?

Tags (1)
0 Karma

kbecker
Communicator

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this.

Thanks,
Ken

0 Karma

sundareshr
Legend

Main searches in postprocess dashboard, has a limit of 500K events returned. It is advisable to limit by using a transforming command in the main search. Try something like this...

*Main Search*

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | bin span=30m _time | stats count sum(OPERATION) by _time OPERATION

*Sub Search 1*

| timechart span=1d sum(count) as count by OPERATION limit=0

*Sub Search 2*

|search OPERATION="XXXXXX" | fields - OPERATION - count

and so on...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...