Aria Operations for Logs Export Events and Charts

We recently discussed pulling events from Operations for Logs via API, but I also discovered something in the UI people might like to know. That is, when you're exporting events from the UI there is a threshold at which you are forced to export events to an NFS share and that threshold is 20,000 events.

Run a query (any query) that results in fewer than 20,000 events. Once complete, click the Export button top right. You can export the Event Results in three different formats: Raw (.txt), JSON, or CSV.

Now, run another query that has more than 20,000 events returned, something like this.

Now try to export the event results and you'll notice this.

You are forced to export the results to an NFS share, you can't export/download TXT/JSON/CSV directly.

I also tested the export chart results capability but wasn't able to determine a maximum. The Charts are a bit different in that they are summarized data over time, they can be grouped by field/s, and more. Internal documentation indicates charts grouped by time have a limit of 2000 groups, if one grouping (other than time) its limited to 100, and if there is more than 1 grouping its 40. Thanks for this information Matt Goodnow!