Getting Data In

Event annotations getting truncated?

pkol
Explorer

Hey guys,
I have been trying to add some event annotations to my line graph but keep getting the following error on the panel:
"[annotation] The results are truncated (1000 of 2379 have been fetched)"

The exact search has been used previously in another panel(not for event annotations) and the data shows up in a different visualisation with no problem.
This is my subsearch which is exactly the same for the "annotation" search.

<search base="transac_base" id="pie">
          <query>| where source=$app_source$
| eval status=if(like(_raw,"%OK%"),"Success",if(like(_raw,"%FAILED%"),"Fail",if(like(_raw,"%already%"),"Running","Timed out/still running")))
|stats count by status</query>

Please HELP!!

0 Karma

cstump_splunk
Splunk Employee
Splunk Employee

The limitation is set in visualizations.conf:

[area]
data_sources.annotation.params.count = 1000

[column]
data_sources.annotation.params.count = 1000

[line]
data_sources.annotation.params.count = 1000

Notice there is limit for each chart type that supports annotations. Since you are working with a line graph, you will want raise the limit in the '[line]' stanza. 

0 Karma

woodcock
Esteemed Legend

Show us your base search.

0 Karma

pkol
Explorer

Hi, this is my base search :


index=synthetic sourcetype=synthetic source = *|fields *|transaction startswith=running by source

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...

Join the Final Session of the Data Management & Federation Bootcamp Series

Over the past three sessions of the Data Management & Federation Bootcamp Series, we've explored how to build ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...