When running a search against a weblog, and attempting to "|timechart span=1h limit=0 count by queryname" for 24hrs, I get the " Your search generated too much data for the current visualization configuration."
Is it just truncating the graph, or the statistics table as well?
Have you opened a case with Splunk for this? This is a hard limit which we have an enhancement request ticket open, more customers requesting this to be raised should push Splunk to fix this.
Hi mikelanghorst,
according to the docs this message is from the JSChart Module and related to the object rendering limit in the chart library.
running this test search on my development box
index=_internal | timechart span=10sec count
returns about 4700 events in the statistic table but brings the message
These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached.
on the report graph.
So from my understanding this message is completely related to the chart and not effects the statistic table.
hope this helps ...
cheers, MuS