Getting Data In

Event annotations getting truncated?

pkol
Explorer

Hey guys,
I have been trying to add some event annotations to my line graph but keep getting the following error on the panel:
"[annotation] The results are truncated (1000 of 2379 have been fetched)"

The exact search has been used previously in another panel(not for event annotations) and the data shows up in a different visualisation with no problem.
This is my subsearch which is exactly the same for the "annotation" search.

<search base="transac_base" id="pie">
          <query>| where source=$app_source$
| eval status=if(like(_raw,"%OK%"),"Success",if(like(_raw,"%FAILED%"),"Fail",if(like(_raw,"%already%"),"Running","Timed out/still running")))
|stats count by status</query>

Please HELP!!

0 Karma

cstump_splunk
Splunk Employee
Splunk Employee

The limitation is set in visualizations.conf:

[area]
data_sources.annotation.params.count = 1000

[column]
data_sources.annotation.params.count = 1000

[line]
data_sources.annotation.params.count = 1000

Notice there is limit for each chart type that supports annotations. Since you are working with a line graph, you will want raise the limit in the '[line]' stanza. 

0 Karma

woodcock
Esteemed Legend

Show us your base search.

0 Karma

pkol
Explorer

Hi, this is my base search :


index=synthetic sourcetype=synthetic source = *|fields *|transaction startswith=running by source

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...