Splunk Search

the specified span would result in too many (>50000) rows

perlish
Communicator

when I create the dashboard,it comes some error like "the specified span would result in too many (>50000) rows".
How can I solve the problem?
Thank you !alt text

1 Solution

bmacias84
Champion

If you don't mind a performance hit on you Search/Indexers you can edit your limits.conf. Editing these settings to an unreasonable level may cause instability.


max_mem_usage_mb = 500 #default memory usage per search is 200MB probably need to increase to support that many rows
[searchresults]
maxresultrows = 86400 #default return for rows is 50000

Bucket

There are numerous settings regarding search and search command limits. I would probably use bucket to roll up your search into something more manageable.


somesearch | bucket _time as mytime span=30m | stats avg(Field) by mytime,Field3

Hope this helps or gives you ideas. Don't forget to accept answers and thumbs up if they help.

Cheers,

View solution in original post

bmacias84
Champion

If you don't mind a performance hit on you Search/Indexers you can edit your limits.conf. Editing these settings to an unreasonable level may cause instability.


max_mem_usage_mb = 500 #default memory usage per search is 200MB probably need to increase to support that many rows
[searchresults]
maxresultrows = 86400 #default return for rows is 50000

Bucket

There are numerous settings regarding search and search command limits. I would probably use bucket to roll up your search into something more manageable.


somesearch | bucket _time as mytime span=30m | stats avg(Field) by mytime,Field3

Hope this helps or gives you ideas. Don't forget to accept answers and thumbs up if they help.

Cheers,

martin_mueller
SplunkTrust
SplunkTrust

Sounds like you have a timechart with a short span over a long range. For example, a span=1s over a range of 24 hours would result in 86400 rows, not reasonable to chart that. You could either set the number of bins instead of the span, increase the span, or reduce the range.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...