Splunk® Enterprise

Developing Views and Apps for Splunk Web

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

About JSChart, Splunk Enterprise primary charting library

JSChart, a JavaScript-based charting library, is the default library for rendering charting graphics. Because JSChart uses JavaScript to render charting graphics, it ensures that platforms, such as iOS, that cannot display Flash-based graphics can display charts. The JSChart library also provides better printing quality.

Charts in search results or in reports are always rendered with JSChart. Charts in dashboards can be a different matter. The charting library used to render them and the way they handle chart customizations depends on a number of factors including the type of XML upon which the dashboard is based and the technology you use to view the dashboard. See the "Dashboards and JSChart" subsection below for details.

Dashboards and JSChart

The manner in which dashboards render chart displays can be affected by the following:

  • Whether the dashboard is based on simple XML or advanced XML.
    Any dashboard that you create and edit with Splunk Web, using the Report Builder, the Add to Dashboard dialog, and the Dashboard and Panel Editors, are based on simple XML. Simple XML does not support Flash charts. A Flash chart referenced in simple XML does not display.

    You can convert simple XML dashboards to advanced XML or you can build advanced XML dashboards from scratch (see "About advanced XML" in the Developing Views and Apps for Splunk Web manual for more information).
  • Addition of chart customizations that are unsupported by JSChart.
    You can apply chart customizations by editing the dashboard XML. Most, but not all, of the customizations are supported by JSChart. If you use a JSChart-unsupported customization, different things can happen depending on the type of XML you are using and the technology you use to view the dashboard.
Note: The tables in this reference have a Supported in JSChart? column that indicates the properties that render in JSChart.
  • The technology used to view the dashboard.
    Charts that include customizations that are not supported by JSChart can have a different appearance when viewed through iOS mobile devices. There are similar display issues when you print PDFs of dashboards that include customizations that are not supported by JSChart. For more information about PDF printing see Generate PDFs of your reports and dashboards.

The following table details the behavior of charts with respect to the JSChart library:

Viewing medium Simple XML
JSChart supports all properties
Simple XML
JSChart supports some properties
Advanced XML
Browser, non-iOS mobile device

Chart graphics render with JSChart. Chart graphics render with JSChart. Unsupported properties do not display. Graphics use the library that is specified in the XML code.
iOS mobile device Chart graphics render with JSChart. Chart graphics render with JSChart. Unsupported properties do not display. With advanced XML, charting libraries for panels are specified at the panel level.

Chart graphics for panels using JSChart are rendered with JSChart. JSChart-unsupported properties are ignored.

Chart graphics for panels using FlashChart are not rendered in iOS devices.

PDF of a report or dashboard Prints PDF using JSChart to render chart graphics. Prints PDF using JSChart to render chart graphics. Ignores properties that are unsupported by JSChart. PDF printing is unsupported for Advanced XML dashboards.

For example, consider a dashboard created using simple XML that contains a panel with a line chart. If you specify a lineStyle property that is not supported by JSChart, the chart renders without the specified property.

JSChart display issues

The JSChart charting library has some display issues that may be resolved in upcoming releases.

Non-transforming searches

The JSChart library cannot render charts based on searches that do not include, or properly use, transforming search commands such as chart, timechart, stats, or eval.

The FlashChart charting library attempts to chart the results of non-transforming searches, but charts do not revert to FlashChart automatically for non-transforming searches. You need to explicitly specify that to use the FlashChart library in the charting XML.

Time Charting

JSChart can only plot time-based data using the timechart command. If you try to plot a time-based series using any other transforming search command, JSChart treats the timestamp data as a series of strings.

FlashChart can plot time-based data with other transforming search commands.

Search result truncation

For performance reasons, the JSChart library truncates search result data sets that are too large. The exact limits that trigger this truncation depend on the browser being used as well as the charting configuration. When the JSChart library is caused to truncate data sets, it displays an error message below the chart. To remove the error message you can:

  • Switch to a chart type that involves drawing only one shape per series (in other words, move from a column chart to a line chart).
  • Reduce the number of fields to plot.
  • For time charts, use a longer time-span between data points.

There are additional conditions that can cause truncation:

  • Searches that return too many results per series can cause JSChart to hang the browser.
    Splunk employs a throttling strategy that restricts the number of results returned per series to 500 by default. You can configure this value by going to JSChart.conf and changing the maxResultsCount parameter to something other than 500.
  • JSChart can only plot the first 50 series that are returned.
    Additional series are not plotted.
  • Object rendering limits by charting library.
    Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit, change either the search string or search time range so that the results returned fall under the limit.
    • For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.
    • The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. An error message displays if you reach the limit with a chart that uses JSChart.

      You can override the truncation limit for charts rendered with JSChart by changing the value of the charting.chart.resultTruncationLimit property on a per-chart basis. This property is only available for panels rendered with JSChart. Increasing the truncation limit can have a negative effect on dashboard performance.

You cannot change the FlashChart truncation limit of 2000 objects.

See the charting reference documentation for chart and legend properties in this manual for more information.

Category limit

In JSChart, when you are plotting data on a categorical axis, no more than 80 categories can be displayed. When there are more than 80 categories, the chart does not truncate the data. Instead, the chart hides the labels and tick marks. This is not configurable. You can encoutner performance issues if you go higher than 80 categories. If you need to display a large number of axis categories, use FlashChart, which has a much higher limit.

Last modified on 18 June, 2015
Chart customization
Chart and legend properties

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters