Hey guys,
I have been trying to add some event annotations to my line graph but keep getting the following error on the panel:
"[annotation] The results are truncated (1000 of 2379 have been fetched)"
The exact search has been used previously in another panel(not for event annotations) and the data shows up in a different visualisation with no problem.
This is my subsearch which is exactly the same for the "annotation" search.
<search base="transac_base" id="pie">
<query>| where source=$app_source$
| eval status=if(like(_raw,"%OK%"),"Success",if(like(_raw,"%FAILED%"),"Fail",if(like(_raw,"%already%"),"Running","Timed out/still running")))
|stats count by status</query>
Please HELP!!
The limitation is set in visualizations.conf:
[area]
data_sources.annotation.params.count = 1000
[column]
data_sources.annotation.params.count = 1000
[line]
data_sources.annotation.params.count = 1000
Notice there is limit for each chart type that supports annotations. Since you are working with a line graph, you will want raise the limit in the '[line]' stanza.
Show us your base search.
Hi, this is my base search :
index=synthetic sourcetype=synthetic source = *|fields *|transaction startswith=running by source