Splunk Search

splunk chart issue

rameshlpatel
Communicator

Hi ,

In splunk, I am trying to create chart for each day (24 hrs) with span of every minute.

e.g. index="monitor" source=* | timecart span=1m avg(time)

but to do this its giving following msg :

These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached.

Tags (3)
0 Karma

sloshburch
Ultra Champion

If you turn this into a dashboard, you can use the charting.data.count option to set a higher limit (even unlimited (0) if you're feeling dangerous).
http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...