Aggregated data limit was reached

Explanation

The accumulator process counts and prepares events and flows in data accumulations to assist with searches, displaying charts, and report performance. The accumulator process aggregates data in pre-defined time spans to create aggregate data views. An aggregate data view is a data set that is used to draw a time series graph, create scheduled reports, or trigger anomaly detection rules.

The system is limited to 300 active aggregate data views.

When the aggregate data view limit is reached, the notification is generated. As users attempt to create new anomaly rules, reports, or saved searches, they are prompted in the user interface that the system is at the limit.

User response

To resolve this issue, administrators can review the active aggregate data views on the Admin tab in the Aggregated Data Management window. The aggregated data management feature provides information on the reports, searches, and anomaly detection rules in use by each aggregate data view. The administrator can review the list of aggregate data views to determine what data is most import to the users. Aggregate data views can be disabled to allow users to create a new rule, report, or saved search that requires an aggregate data view.

If the administrator decides to delete an aggregate data view, a summary provides an outline of the searches, rules, or reports affected. To re-create a deleted aggregate data view, the administrator needs only to re-enable or re-create the search, anomaly rule, or report. The system automatically creates the aggregate data view based on the data required.