help span would result in too many rows

[dhavamanis]

we are getting this error more frequently, can you please tell us the optimized settings to avoid this error,

The specified span would result in too many (>50000) rows.

[martin_mueller · Accepted solution]

Yeah, that's a timechart error.

Assuming you're specifying span=foo, either replace foo with a value more appropriate for your time range or switch to specifying bins=200 or some other number instead. That'll make sure timechart will only generate up to 200 rows.

Alternatively, leave off both settings and let the default bins=100 take over for now.

[martin_mueller]

Use this instead:

index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11"
| bin span=1s _time | top 1 _time | table count

[dhavamanis]

thank you! it works fine.

[dhavamanis]

we are using this query and getting results with warning message,

index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11" | timechart span=1s count(API_KEY) | sort count(API_KEY) desc | head 1 | table count(API_KEY)

[somesoni2]

What command are you using, timechart?