Dashboards & Visualizations

Query Limit on a UI view?

jgauthier
Contributor

I've built a very small example to reproduce a problem I am having. Using this page as an example:
http://www.splunk.com/base/Documentation/4.2.1/Developer/FormSearchPostProcess

I've built a dashboard that looks like this:


  <searchTemplate>sourcetype="Exchange2010" sender="$sender$"</searchTemplate>

  <fieldset>
    <input type="text" token="sender">
      <label>Sender</label>
      <seed>*</seed>
    </input>

    <input type="time">
    <default>Last 30 days</default>
    </input>
  </fieldset>

  <row>
    <chart>
      <title>Requests over time for result set</title>
      <searchPostProcess>timechart count as "Requests"</searchPostProcess>
      <option name="charting.chart">column</option>
    </chart>
  </row>

  <row>
    <chart>
      <title>Top users in result set</title>
      <searchPostProcess>top 10 recipient</searchPostProcess>
      <option name="charting.chart">pie</option>
    </chart>

  </row>

  <row>
    <table>
      <title>Requests in result set</title>
      <searchPostProcess>sort - _time | fields _time, sender, recipient</searchPostProcess>
      <fields>_time, sender, recipient</fields>
      <option name="showPager">true</option>
      <option name="count">30</option>
      <option name="displayRowNumbers">false</option>
      </table>
  </row>
</form>

Regardless of the "Time" chosen, the query seems to abort just after hitting 10,000 rows.
Is this a known limitation? Is there a configuration change I can make to get more?
In some instances, this is only good for a day or two of data, and after that short data. for instance, I can select 30 days, but I really only get about 6.

It always seems to stop short. I'm not sure why, but I never get more than 13,000 records.

Thanks!

Tags (1)
0 Karma
1 Solution

melting
Splunk Employee
Splunk Employee

Post process is limited to 10,000 events. If you want the full amount you can split into unique searches.

Some values are configurable in limits.conf

View solution in original post

melting
Splunk Employee
Splunk Employee

Post process is limited to 10,000 events. If you want the full amount you can split into unique searches.

Some values are configurable in limits.conf

swdonline
Path Finder

@jgauthier - He's saying instead of doing a single searchTemplate and then searchPostProcess for each chart, get rid of searchPostProcess and do a searchTemplate within each chart. It means you're going to run more searches, but ultimately will be able to surpass the 10,000 event limit.

0 Karma

jgauthier
Contributor

I'm not sure I understand "split into unique searches." and how it applies to this. Could you elaborate?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...