error in timechart command and too many bins

[bwojciechowski]

I am getting the following error

Error in 'timechart' command: Span value '1m' results in too many (> 50000) bins. Edit limits.conf to change limits.

In my limits.conf file maxbins is not set, but maxresultsrow is set to a larger number. The comments state that if maxbins is not specified, it will default to the maxresultsrows

[searchresults]
maxresultrows = 5000000

commented line: if maxbins not specified or = 0, defaults to searchresults::maxresultrows

Any assistance would be appreciated.

[Dan]

How can you be sure that maxbins is not set? It does get set in $SPLUNK_HOME/etc/system/default/limits.conf, specifically:

[discretize]
maxbins = 50000

Have you tried updating this (by creating a etc/system/local/limits.conf)? You can also run the CLI command:

> splunk.exe cmd btool limits list