About JSChart, Splunk's primary charting library
Splunk charts in search results or in reports are always rendered with JSChart. Charts in dashboards can be a different matter--the charting library used to render them and the way they handle chart customizations depends on a number of factors including the type of XML upon which the dashboard is based and the technology you use to view the dashboard. See the "Dashboards and JSChart" subsection below for details.
Dashboards and JSChart
The manner in which dashboards render chart displays can be affected by the following:
- Whether the dashboard is based on simple XML or advanced XML. Any dashboard that you create and edit solely through Splunk Web (by using the Report Builder, the Add to Dashboard dialog, and the Dashboard and Panel Editors) will be based on simple XML. You can convert simple XML dashboards to advanced XML automatically or you can build advanced XML dashboards from scratch (see "About advanced XML" in the Developing Views and Apps for Splunk Web manual for more information).
- Addition of chart customizations that are unsupported by JSChart. You can apply chart customizations by editing the dashboard XML. Most of the more popular customizations are supported by JSChart, but some aren't. If you use a JSChart-unsupported customization, different things can happen depending on what type of XML you're using and what technology you're using to view the dashboard with.
- Note: Each of the tables in this custom chart configuration reference has a Supported in JSChart? column that tells you which properties are supported and which aren't.
- The technology used to view the dashboard. Splunk charts can have a different appearance when viewed through iOS mobile devices (iPad/iPhone/iPod) if the charts include customizations that are unsupported by JSChart. And if you're printing PDFs of dashboards you'll find similar display issues for simple XML dashboards that include customizations that are unsupported by JSChart.
For more information about PDF printing see "Upgrade PDF printing for Splunk Web" in the Installation Manual. Here's what happens with charts in dashboards, depending on the combination of these factors that you're working with:
|Viewing medium||Simple XML with all properties supported by JSChart||Simple XML with some properties unsupported by JSChart||Advanced XML|
|Browser, non-iOS mobile device
||Chart graphics are rendered with JSChart.||Chart graphics are rendered with FlashChart.||Chart graphics are rendered with whichever charting library is specified in the XML for each dashboard panel.|
|iOS mobile device||Chart graphics are rendered with JSChart .||Chart graphics are rendered with JSChart. JSChart-unsupported customizations are ignored.||With advanced XML, charting libraries for panels are specified at the panel level.|
Chart graphics for panels using JSChart are rendered with JSChart. JSChart-unsupported customizations are ignored.
Chart graphics for panels using FlashChart are not rendered in iOS devices.
|PDF of a report or dashboard||Prints PDF using JSChart to render chart graphics.||Prints PDF using JSChart to render chart graphics. Ignores customizations that are unsupported by JSChart.||PDF printing is unsupported for Advanced XML dashboards.|
For example, consider a dashboard created using simple XML that contains a panel with a line chart. If you include a
lineStyle chart customization property to affect the way the chart lines appear, Splunk renders the line chart with FlashChart because this property is unsupported by JSChart. The line chart displays correctly in browsers that support Flash, but won't show up on platforms that do not support Flash, such as an iPad.
JSChart display issues
The JSChart charting library has some display issues that may be resolved in upcoming releases.
The JSChart library cannot render charts based on searches that do not include (or properly use) transforming search commands such as
The FlashChart charting library will attempt to chart the results of non-transforming searches, but charts won't revert to FlashChart automatically when non-transforming searches are used. You will need to explicitly specify that Splunk use the FlashChart library in the charting XML.
JSChart can only plot time-based data using the
timechart command. If you try to plot a time-based series using any other transforming search command, JSChart treats the timestamp data as a series of strings.
FlashChart can plot time-based data with other transforming search commands.
Search result truncation
For performance reasons, the JSChart library truncates search result data sets that are too large. The exact limits that trigger this truncation depend on the browser being used as well as the charting configuration. When the JSChart library is caused to truncate data sets, it displays an error message below the chart. To remove the error message you can:
- Switch to a chart type that involves drawing only one shape per series (in other words, move from a column chart to a line chart).
- Reduce the number of fields that are being plotted.
- For time charts, use a longer time-span between data points.
There are additional conditions that can cause truncation:
- Searches that return too many results per series can cause JSChart to hang the browser. Splunk employs a throttling strategy that restricts the number of results returned per series to 500 by default. You can configure this value by going to
JSChart.confand changing the
maxResultsCountparameter to something other than
- JSChart can only plot the first 50 series that are returned. Additional series will not be plotted.
- Object rendering limits by charting library. Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit you'll want to change either the search string or search time range so that the results returned fall under the limit.
- For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.
- The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. If you hit the limit with a chart that uses JSChart, Splunk provides an error message.
Note: You can override the truncation limit for charts rendered with JSChart by changing the value of the
charting.chart.resultTruncationLimit property on a per-chart basis. Note that this property is only available for panels rendered with JSChart. Also, be aware that increasing this truncation limit can have a negative effect on dashboard performance.
You can't change the FlashChart truncation limit of 2000 objects.
See the charting reference documentation for chart and legend properties in this manual for more information.
In JSChart, when you are plotting data on a categorical axis, no more than 80 categories can be displayed. When there are more than 80 categories Splunk doesn't truncate the data but instead hides the labels and tick marks. This is not configurable; Splunk runs into performance issues if you go higher than this. If you need to display a large number of axis categories, use FlashChart. It has a much higher limit.
Overview of the custom chart configuration reference
Chart and legend properties
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18