we are getting this error more frequently, can you please tell us the optimized settings to avoid this error,
The specified span would result in too many (>50000) rows.
Yeah, that's a timechart
error.
Assuming you're specifying span=foo
, either replace foo
with a value more appropriate for your time range or switch to specifying bins=200
or some other number instead. That'll make sure timechart
will only generate up to 200 rows.
Alternatively, leave off both settings and let the default bins=100
take over for now.
Yeah, that's a timechart
error.
Assuming you're specifying span=foo
, either replace foo
with a value more appropriate for your time range or switch to specifying bins=200
or some other number instead. That'll make sure timechart
will only generate up to 200 rows.
Alternatively, leave off both settings and let the default bins=100
take over for now.
Use this instead:
index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11"
| bin span=1s _time | top 1 _time | table count
thank you! it works fine.
we are using this query and getting results with warning message,
index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11" | timechart span=1s count(API_KEY) | sort count(API_KEY) desc | head 1 | table count(API_KEY)
What command are you using, timechart?