Dashboard Panel Warning


1 comment

  • Avatar
    Kevin Keech

    Dashboard monitors currently have a limit of 1000 initial groupings. The grouping is taken at the first aggregation function within the query. In your case this is the "most_recent" operation in your query, which creates a list of users by role before you then re-aggregate them to get counts per role. You can see this if you run your query just up to and including the "most_recent" operation.

    Based on your query I think the following query may get you the same/similar results and should work to bypass the limitations.

    Func=View Op=Feed

    | where !(isNull(Role))

    | timeslice 1d

    | count_distinct(AuthUser) by Role, _timeslice

    | transpose row _timeslice column Role as *


    The 1000 group limit is noted in the following help doc on Restricted Operators

    I hope this helps!

    Comment actions Permalink

Please sign in to leave a comment.