Getting Data In

Event annotations getting truncated?

pkol
Explorer

Hey guys,
I have been trying to add some event annotations to my line graph but keep getting the following error on the panel:
"[annotation] The results are truncated (1000 of 2379 have been fetched)"

The exact search has been used previously in another panel(not for event annotations) and the data shows up in a different visualisation with no problem.
This is my subsearch which is exactly the same for the "annotation" search.

<search base="transac_base" id="pie">
          <query>| where source=$app_source$
| eval status=if(like(_raw,"%OK%"),"Success",if(like(_raw,"%FAILED%"),"Fail",if(like(_raw,"%already%"),"Running","Timed out/still running")))
|stats count by status</query>

Please HELP!!

0 Karma

cstump_splunk
Splunk Employee
Splunk Employee

The limitation is set in visualizations.conf:

[area]
data_sources.annotation.params.count = 1000

[column]
data_sources.annotation.params.count = 1000

[line]
data_sources.annotation.params.count = 1000

Notice there is limit for each chart type that supports annotations. Since you are working with a line graph, you will want raise the limit in the '[line]' stanza. 

0 Karma

woodcock
Esteemed Legend

Show us your base search.

0 Karma

pkol
Explorer

Hi, this is my base search :


index=synthetic sourcetype=synthetic source = *|fields *|transaction startswith=running by source

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!