I'm trying to create my first event canvas workpad.
I have an index that contains at least 100K unique hostnames. But when I create a metric element to display count of unique hostnames, it show maximum count as 1000.
Now the queries that I have are,
- Does canvas pulls all the data from index or is it timebound? If it is timebound then what is the default value for time duration for which it pulls data by default?
- Event though I add a time filter element and select a time period as 24 hrs, it still show maximum metric value as 1000. Why is that?
- Does it use HyperLog++ algorithm like Elasticsearch cardinality aggregation to calculate possible unique values?
- Is it at all possible to show count of unique values if there is such high variation in data?