I am trying to run the below to get the avg/max number of hits per second each day. I have tried this multiple times and sometimes it works without issues (esp. for "Previous Month") and sometimes I get the the specified span would result in too many (>50000) rows (esp. for Today or Previous Week)
host = host sourcetype=sourcetype | fields linecount _time -_* |fields linecount _time -_* | timechart span=1s count | timechart span=1d max(count) avg(count)
Any thoughts on why I would sometimes get this error when running the same query for the same time period?
Thanks!
... View more