Timechart with large split by gives" Your search generated too much data for the current visualization configuration." Is it truncating stats or chart or both?

[mikelanghorst]

When running a search against a weblog, and attempting to "|timechart span=1h limit=0 count by queryname" for 24hrs, I get the " Your search generated too much data for the current visualization configuration."

Is it just truncating the graph, or the statistics table as well?

[kbecker]

Have you opened a case with Splunk for this? This is a hard limit which we have an enhancement request ticket open, more customers requesting this to be raised should push Splunk to fix this.

[MuS]

Hi mikelanghorst,

according to the docs this message is from the JSChart Module and related to the object rendering limit in the chart library.

running this test search on my development box

index=_internal | timechart span=10sec count

returns about 4700 events in the statistic table but brings the message

These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. 

on the report graph.
So from my understanding this message is completely related to the chart and not effects the statistic table.

hope this helps ...

cheers, MuS