We have several dashboards where we need to display more than the default 100 results in a visualization. In 6.2.x we where able to use :
but in 6.3.0, using this option leads to the following output:
"These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. "
Even trying to set
to deactivate the limit completely is not working anymore.
Is this problem already known?
Thank you and regards
This is a bug in 6.3. and has been fixed in the recent 6.3.1 maintenance release (released on 11/4/15).
Find more information and all bugfixes in the 6.3.1. Release Notes
View solution in original post
Thank you for the answer.
We will update our test infrastructure and have see if the fix works before going to the productive one.
We are using 6.3.1 and I still see the " These results may be truncated. Your search generated too much data for the current visualization configuration." message even with the following two options set. Is there still an bug associated with this?
This is the search
earliest=-60m index=_introspection host=carf-splunkil* component=Hostwide | timechart useother=f limit=80 span=10s values(data.normalized_load_avg_1min) by host