Getting Data In

Event annotations getting truncated?

pkol
Explorer

Hey guys,
I have been trying to add some event annotations to my line graph but keep getting the following error on the panel:
"[annotation] The results are truncated (1000 of 2379 have been fetched)"

The exact search has been used previously in another panel(not for event annotations) and the data shows up in a different visualisation with no problem.
This is my subsearch which is exactly the same for the "annotation" search.

<search base="transac_base" id="pie">
          <query>| where source=$app_source$
| eval status=if(like(_raw,"%OK%"),"Success",if(like(_raw,"%FAILED%"),"Fail",if(like(_raw,"%already%"),"Running","Timed out/still running")))
|stats count by status</query>

Please HELP!!

0 Karma

cstump_splunk
Splunk Employee
Splunk Employee

The limitation is set in visualizations.conf:

[area]
data_sources.annotation.params.count = 1000

[column]
data_sources.annotation.params.count = 1000

[line]
data_sources.annotation.params.count = 1000

Notice there is limit for each chart type that supports annotations. Since you are working with a line graph, you will want raise the limit in the '[line]' stanza. 

0 Karma

woodcock
Esteemed Legend

Show us your base search.

0 Karma

pkol
Explorer

Hi, this is my base search :


index=synthetic sourcetype=synthetic source = *|fields *|transaction startswith=running by source

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...