TSVB "Your query attempted to fetch too much data." when interval is changed

[Joshua_Boyd]

Fails with 1m interval

For 30day interval or greater it works fine, but i I want to group by month

I set the advance setting from 2000 to 10000 based on another thread, but no luck

Any ideas?

[stephenb (Stephen Brown)]

Hi @Joshua_Boyd Welcome to the community

What is the Time Range of the Top Visualization 16 Weeks

Interval = 1m over 16 Weeks?

16 x 7 x 24 x 27 = 161,280 Buckets

That is toooo many in several ways...

1. It is just flat out too many buckets to aggregate by 161K buckets to aggregate is too many.
2. What would you expect to see with 161K Individual Data Points on your Screen? You would not be able to render all that data anyways, so it would just get aggregated smoothed down anyways

What are you trying to accomplish?

1000 Buckets Max is there for a reason.

Try setting it to Auto...

Auto will take the Overall Time Range and pick a decent interval bucket.

[Joshua_Boyd]

Thanks Stephen.

Maybe I'm not going about it the right way.

the bar graphs represent volume of incidents.

I want a bar for
Jan 2023
February 2023
March 2023

Im new to elastic

playing with the interval i assumed that's how i group by date.

I don't know if i understand buckets, i can research that.

What i found interesting is if i change my interval to 40 days it blocks / bars of data by 40 days; so i was thinking blocking / baring data by month should not be a challenge

if i choose auto and select course it just does 4 week intervals

Let me know if my objective makes sense and if you can think of a different approach or something im not doing....appreciate it.

[Joshua_Boyd]

Just building on that i took my TSVB down to just the bar graph

It doesn't make sense to me that my start time in this graph is 11/27 when i say start december 1

[stephenb (Stephen Brown)]

What version are you on... If on newer versions I would use Lens and set the Date Histogram to Months...