I have been trying to add some event annotations to my line graph but keep getting the following error on the panel:
"[annotation] The results are truncated (1000 of 2379 have been fetched)"
The exact search has been used previously in another panel(not for event annotations) and the data shows up in a different visualisation with no problem.
This is my subsearch which is exactly the same for the "annotation" search.
<search base="transac_base" id="pie">
<query>| where source=$app_source$
| eval status=if(like(_raw,"%OK%"),"Success",if(like(_raw,"%FAILED%"),"Fail",if(like(_raw,"%already%"),"Running","Timed out/still running")))
|stats count by status</query>