the specified span would result in too many (>50000) rows

[perlish]

when I create the dashboard,it comes some error like "the specified span would result in too many (>50000) rows".
How can I solve the problem?
Thank you !

[bmacias84 · Accepted solution]

If you don't mind a performance hit on you Search/Indexers you can edit your limits.conf. Editing these settings to an unreasonable level may cause instability.

max_mem_usage_mb = 500 #default memory usage per search is 200MB probably need to increase to support that many rows

[searchresults]

maxresultrows = 86400 #default return for rows is 50000

Bucket

There are numerous settings regarding search and search command limits. I would probably use bucket to roll up your search into something more manageable.

somesearch |  bucket _time as mytime span=30m | stats avg(Field) by mytime,Field3

Hope this helps or gives you ideas. Don't forget to accept answers and thumbs up if they help.

Cheers,

[martin_mueller]

Sounds like you have a timechart with a short span over a long range. For example, a span=1s over a range of 24 hours would result in 86400 rows, not reasonable to chart that. You could either set the number of bins instead of the span, increase the span, or reduce the range.