I have been trying to add some event annotations to my line graph but keep getting the following error on the panel:
"[annotation] The results are truncated (1000 of 2379 have been fetched)"
The exact search has been used previously in another panel(not for event annotations) and the data shows up in a different visualisation with no problem.
This is my subsearch which is exactly the same for the "annotation" search.
<search base="transac_base" id="pie"> <query>| where source=$app_source$ | eval status=if(like(_raw,"%OK%"),"Success",if(like(_raw,"%FAILED%"),"Fail",if(like(_raw,"%already%"),"Running","Timed out/still running"))) |stats count by status</query>
The limitation is set in visualizations.conf:
[area] data_sources.annotation.params.count = 1000 [column] data_sources.annotation.params.count = 1000 [line] data_sources.annotation.params.count = 1000
Notice there is limit for each chart type that supports annotations. Since you are working with a line graph, you will want raise the limit in the '[line]' stanza.