Splunk Search

Timechart with large split by gives" Your search generated too much data for the current visualization configuration." Is it truncating stats or chart or both?

mikelanghorst
Motivator

When running a search against a weblog, and attempting to "|timechart span=1h limit=0 count by queryname" for 24hrs, I get the " Your search generated too much data for the current visualization configuration."

Is it just truncating the graph, or the statistics table as well?

Tags (2)

kbecker
Communicator

Have you opened a case with Splunk for this? This is a hard limit which we have an enhancement request ticket open, more customers requesting this to be raised should push Splunk to fix this.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mikelanghorst,

according to the docs this message is from the JSChart Module and related to the object rendering limit in the chart library.

running this test search on my development box

index=_internal | timechart span=10sec count

returns about 4700 events in the statistic table but brings the message

These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. 

on the report graph.
So from my understanding this message is completely related to the chart and not effects the statistic table.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...