I am getting the following error
Error in 'timechart' command: Span value '1m' results in too many (> 50000) bins. Edit limits.conf to change limits.
In my limits.conf file maxbins is not set, but maxresultsrow is set to a larger number. The comments state that if maxbins is not specified, it will default to the maxresultsrows
[searchresults]
maxresultrows = 5000000
commented line: if maxbins not specified or = 0, defaults to searchresults::maxresultrows
Any assistance would be appreciated.
How can you be sure that maxbins is not set? It does get set in $SPLUNK_HOME/etc/system/default/limits.conf, specifically:
[discretize]
maxbins = 50000
Have you tried updating this (by creating a etc/system/local/limits.conf)? You can also run the CLI command:
> splunk.exe cmd btool limits list