Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

About JSChart, Splunk's primary charting library

Splunk uses JSChart, a JavaScript-based charting library, to render charting graphics whenever possible. Because JSChart uses JavaScript to render charting graphics, it ensures that platforms that cannot display Flash-based graphics (such as iOS) can display Splunk charts. The JSChart library also provides better printing quality.

Splunk charts in search results or in reports are always rendered with JSChart. Charts in dashboards can be a different matter--the charting library used to render them and the way they handle chart customizations depends on a number of factors including the type of XML upon which the dashboard is based and the technology you use to view the dashboard. See the "Dashboards and JSChart" subsection below for details.

Dashboards and JSChart

The manner in which dashboards render chart displays can be affected by the following:

  • Whether the dashboard is based on simple XML or advanced XML. Any dashboard that you create and edit solely through Splunk Web (by using the Report Builder, the Add to Dashboard dialog, and the Dashboard and Panel Editors) will be based on simple XML. You can convert simple XML dashboards to advanced XML automatically or you can build advanced XML dashboards from scratch (see "About advanced XML" in the Developing Views and Apps for Splunk Web manual for more information).
  • Addition of chart customizations that are unsupported by JSChart. You can apply chart customizations by editing the dashboard XML. Most of the more popular customizations are supported by JSChart, but some aren't. If you use a JSChart-unsupported customization, different things can happen depending on what type of XML you're using and what technology you're using to view the dashboard with.
Note: Each of the tables in this custom chart configuration reference has a Supported in JSChart? column that tells you which properties are supported and which aren't.
  • The technology used to view the dashboard. Splunk charts can have a different appearance when viewed through iOS mobile devices (iPad/iPhone/iPod) if the charts include customizations that are unsupported by JSChart. And if you're printing PDFs of dashboards you'll find similar display issues for simple XML dashboards that include customizations that are unsupported by JSChart.

For more information about PDF printing see "Upgrade PDF printing for Splunk Web" in the Installation Manual. Here's what happens with charts in dashboards, depending on the combination of these factors that you're working with:

Viewing medium Simple XML with all properties supported by JSChart Simple XML with some properties unsupported by JSChart Advanced XML
Browser, non-iOS mobile device

Chart graphics are rendered with JSChart. Chart graphics are rendered with FlashChart. Chart graphics are rendered with whichever charting library is specified in the XML for each dashboard panel.
iOS mobile device Chart graphics are rendered with JSChart . Chart graphics are rendered with JSChart. JSChart-unsupported customizations are ignored. With advanced XML, charting libraries for panels are specified at the panel level.

Chart graphics for panels using JSChart are rendered with JSChart. JSChart-unsupported customizations are ignored.

Chart graphics for panels using FlashChart are not rendered in iOS devices.

PDF of a report or dashboard Prints PDF using JSChart to render chart graphics. Prints PDF using JSChart to render chart graphics. Ignores customizations that are unsupported by JSChart. PDF printing is unsupported for Advanced XML dashboards.

For example, consider a dashboard created using simple XML that contains a panel with a line chart. If you include a lineStyle chart customization property to affect the way the chart lines appear, Splunk renders the line chart with FlashChart because this property is unsupported by JSChart. The line chart displays correctly in browsers that support Flash, but won't show up on platforms that do not support Flash, such as an iPad.

JSChart display issues

The JSChart charting library has some display issues that may be resolved in upcoming releases.

Non-transforming searches

The JSChart library cannot render charts based on searches that do not include (or properly use) transforming search commands such as chart, timechart, stats, or eval.

The FlashChart charting library will attempt to chart the results of non-transforming searches, but charts won't revert to FlashChart automatically when non-transforming searches are used. You will need to explicitly specify that Splunk use the FlashChart library in the charting XML.

Time Charting

JSChart can only plot time-based data using the timechart command. If you try to plot a time-based series using any other transforming search command, JSChart treats the timestamp data as a series of strings.

FlashChart can plot time-based data with other transforming search commands.

Search result truncation

For performance reasons, the JSChart library truncates search result data sets that are too large. The exact limits that trigger this truncation depend on the browser being used as well as the charting configuration. When the JSChart library is caused to truncate data sets, it displays an error message below the chart. To remove the error message you can:

  • Switch to a chart type that involves drawing only one shape per series (in other words, move from a column chart to a line chart).
  • Reduce the number of fields that are being plotted.
  • For time charts, use a longer time-span between data points.

There are additional conditions that can cause truncation:

  • Searches that return too many results per series can cause JSChart to hang the browser. Splunk employs a throttling strategy that restricts the number of results returned per series to 500 by default. You can configure this value by going to JSChart.conf and changing the maxResultsCount parameter to something other than 500.
  • JSChart can only plot the first 50 series that are returned. Additional series will not be plotted.
  • Object rendering limits by charting library. Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit you'll want to change either the search string or search time range so that the results returned fall under the limit.
    • For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.
    • The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. If you hit the limit with a chart that uses JSChart, Splunk provides an error message.

Note: You can override the truncation limit for charts rendered with JSChart by changing the value of the charting.chart.resultTruncationLimit property on a per-chart basis. Note that this property is only available for panels rendered with JSChart. Also, be aware that increasing this truncation limit can have a negative effect on dashboard performance.

You can't change the FlashChart truncation limit of 2000 objects.

See the charting reference documentation for chart and legend properties in this manual for more information.

Category limit

In JSChart, when you are plotting data on a categorical axis, no more than 80 categories can be displayed. When there are more than 80 categories Splunk doesn't truncate the data but instead hides the labels and tick marks. This is not configurable; Splunk runs into performance issues if you go higher than this. If you need to display a large number of axis categories, use FlashChart. It has a much higher limit.

Overview of the custom chart configuration reference
Chart and legend properties

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters