I am attempting to generate an area chart for the **past 15 days** using the following search:
index=test sourcetype=abcd source=1234 field1=* | timechart span=1h count by field1 useother=f limit=0
field1 has approximately **160 distinct values**. Given this in conjunction with the time range and 1 hour span this results in almost **60,000 data points** to be plotted. When attempting to chart this, I get the error
These results may be truncated. Your search generated too much data for the current visualization configuration.
I have done the following to attempt to resolve this issue:
1. Edit the source XML for the chart/dashboard panel by adding charting.data.count=0
2. Edit the source XML for the chart/dashboard panel by adding charting.resultTruncationLimit=60000
3. Edit the local web.conf file by adding jschart_truncation_limit=0
None of the above fixes have resulted in the chart rendering with all the results. Are there any other potential solutions to this issue that I can try?
Thanks for your assistance.
↧