Post Process Dashboard panel showing "search generated too much data for the current display configuration, results have been truncated"

[rameshnani]

Hello,

I need help on post process,

Here are my queries:

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="*" | timechart span=1d count by OPERATION

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)

I updated my dashboard and I used the post process

Here is my base query:
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | fields *

Sub Queries:

1. |timechart span=1d count by OPERATION
2. |search OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)
3. |search OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)
4. |search OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)

All dashboard panels are working are working fine except 1st one. In the dashboard 1st panel I'm seeing results but there is a warning message saying that "search generated too much data for the current display configuration, results have been truncated."

How to fix this issue? Can I send limited COUNT and AVG data to subqueries(1st panel)?

[kbecker]

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this.

Thanks,
Ken

[sundareshr]

Main searches in postprocess dashboard, has a limit of 500K events returned. It is advisable to limit by using a transforming command in the main search. Try something like this...

*Main Search*

sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | bin span=30m _time | stats count sum(OPERATION) by _time OPERATION

*Sub Search 1*

| timechart span=1d sum(count) as count by OPERATION limit=0

*Sub Search 2*

|search OPERATION="XXXXXX" | fields - OPERATION - count

and so on...