Dashboard Panel Warning
Hello, I'm new to sumo and am creating my first dashboard. However, I can't seem to figure out what to do with this warning that is showing up on a few of my panels: "Unable to include all results. Please edit your search to produce fewer results."
Here's a sample search I'm running:
Func=View Op=Feed | where !(isNull(Role)) | withtime AuthUser | timeslice 1d | most_recent(AuthUser_withtime) as AuthUser by AuthUser, Role, _timeslice | count by Role, _timeslice | transpose row _timeslice column Role as *
NOTE: the query is designed to display the number of unique views of a given page in our application by a user's Role grouped by day over time. In other words, if user 123 visits the page 5 times every day, I only want those views counted once per day.
When I click "Show in search", the query runs just fine without any errors. I tried searching around online for some help but couldn't find anything so I'm hoping someone can spot something that I'm doing wrong.
Thanks
-
Dashboard monitors currently have a limit of 1000 initial groupings. The grouping is taken at the first aggregation function within the query. In your case this is the "most_recent" operation in your query, which creates a list of users by role before you then re-aggregate them to get counts per role. You can see this if you run your query just up to and including the "most_recent" operation.
Based on your query I think the following query may get you the same/similar results and should work to bypass the limitations.
Func=View Op=Feed
| where !(isNull(Role))
| timeslice 1d
| count_distinct(AuthUser) by Role, _timeslice
| transpose row _timeslice column Role as *The 1000 group limit is noted in the following help doc on Restricted Operators
I hope this helps!
Please sign in to leave a comment.
Comments
1 comment