Splunk Search

the specified span would result in too many (>50000) rows

perlish
Communicator

when I create the dashboard,it comes some error like "the specified span would result in too many (>50000) rows".
How can I solve the problem?
Thank you !alt text

1 Solution

bmacias84
Champion

If you don't mind a performance hit on you Search/Indexers you can edit your limits.conf. Editing these settings to an unreasonable level may cause instability.


max_mem_usage_mb = 500 #default memory usage per search is 200MB probably need to increase to support that many rows
[searchresults]
maxresultrows = 86400 #default return for rows is 50000

Bucket

There are numerous settings regarding search and search command limits. I would probably use bucket to roll up your search into something more manageable.


somesearch | bucket _time as mytime span=30m | stats avg(Field) by mytime,Field3

Hope this helps or gives you ideas. Don't forget to accept answers and thumbs up if they help.

Cheers,

View solution in original post

bmacias84
Champion

If you don't mind a performance hit on you Search/Indexers you can edit your limits.conf. Editing these settings to an unreasonable level may cause instability.


max_mem_usage_mb = 500 #default memory usage per search is 200MB probably need to increase to support that many rows
[searchresults]
maxresultrows = 86400 #default return for rows is 50000

Bucket

There are numerous settings regarding search and search command limits. I would probably use bucket to roll up your search into something more manageable.


somesearch | bucket _time as mytime span=30m | stats avg(Field) by mytime,Field3

Hope this helps or gives you ideas. Don't forget to accept answers and thumbs up if they help.

Cheers,

martin_mueller
SplunkTrust
SplunkTrust

Sounds like you have a timechart with a short span over a long range. For example, a span=1s over a range of 24 hours would result in 86400 rows, not reasonable to chart that. You could either set the number of bins instead of the span, increase the span, or reduce the range.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...