rangemap based chart stops "counting" after 50,000 items

[bnolen]

I am performing a statistical analysis against a large (record count) dataset. I am trying to work out the busiest time period for our users.

My search is

<search_string> | fields _time, date_wday | eval myHour=strftime(_time,"%H") | rangemap field=myHour overnight=0-5 morning=6-12 afternoon=13-19 evening=20-23 default=error | chart count over date_wday by range

(The reason for the strftime is because date_hour was showing as the source time which is UTC and I wanted the times aligned to my local time zone)

The problem is that the results table stops incrementing after it hits 50000 even though there is defiantly data in the periods it shows "none"

e.g.:

[sideview · Accepted solution]

Interesting. It looks like rangemap stops at 50,000 events.
Well then I would use some nested if statements in an eval instead of the rangemap command. (Also it seems a lot easier to use the date_hour field instead of building your own from _time)

Tested this out and it seems to scale up far past 50,000 events:

<search_string> | fields date_hour, date_wday | eval range=if(date_hour>19,"evening",if(date_hour>12,"afternoon",if(date_hour>5,"morning","overnight"))) | chart count over date_wday by range

[sideview]

I see. Well unless im still misunderstanding that is not what it will do though--- both 'eval myHour=strftime(_time,"%H")' and date_hour will give hour of the day as interpreted in the server's timezone.

[bnolen]

Perfect, thanks Nick. Just one point, the reason for the strftime was to "report" on the adjusted (i.e. local) time not the raw time in the event.