Different results for error "specified span would result in too many (>50000) rows" based on time range

[keet1009]

I am trying to run the below to get the avg/max number of hits per second each day. I have tried this multiple times and sometimes it works without issues (esp. for "Previous Month") and sometimes I get the the specified span would result in too many (>50000) rows (esp. for Today or Previous Week)

host = host  sourcetype=sourcetype | fields linecount  _time -_* |fields linecount  _time -_* | timechart span=1s count | timechart span=1d max(count) avg(count)

Any thoughts on why I would sometimes get this error when running the same query for the same time period?

Thanks!

[somesoni2]

Give this a try

| tstats count WHERE host = host sourcetype=sourcetype by _time span=1s | timechart span=1d max(count) avg(count)

Since you're using only the default metadata fields, the tstats will give you same results with lightening fast speed.