About JSChart, Splunk Enterprise primary charting library
Charts in search results or in reports are always rendered with JSChart. Charts in dashboards can be a different matter. The charting library used to render them and the way they handle chart customizations depends on a number of factors including the type of XML upon which the dashboard is based and the technology you use to view the dashboard. See the "Dashboards and JSChart" subsection below for details.
Dashboards and JSChart
The manner in which dashboards render chart displays can be affected by the following:
- Whether the dashboard is based on simple XML or advanced XML.
Any dashboard that you create and edit with Splunk Web, using the Report Builder, the Add to Dashboard dialog, and the Dashboard and Panel Editors, are based on simple XML. Simple XML does not support Flash charts. A Flash chart referenced in simple XML does not display.
You can convert simple XML dashboards to advanced XML or you can build advanced XML dashboards from scratch (see "About advanced XML" in the Developing Views and Apps for Splunk Web manual for more information).
- Addition of chart customizations that are unsupported by JSChart.
You can apply chart customizations by editing the dashboard XML. Most, but not all, of the customizations are supported by JSChart. If you use a JSChart-unsupported customization, different things can happen depending on the type of XML you are using and the technology you use to view the dashboard.
- Note: The tables in this reference have a Supported in JSChart? column that indicates the properties that render in JSChart.
- The technology used to view the dashboard.
Charts that include customizations that are not supported by JSChart can have a different appearance when viewed through iOS mobile devices. There are similar display issues when you print PDFs of dashboards that include customizations that are not supported by JSChart. For more information about PDF printing see Generate PDFs of your reports and dashboards.
The following table details the behavior of charts with respect to the JSChart library:
|Viewing medium||Simple XML
JSChart supports all properties
JSChart supports some properties
|Browser, non-iOS mobile device
||Chart graphics render with JSChart.||Chart graphics render with JSChart. Unsupported properties do not display.||Graphics use the library that is specified in the XML code.|
|iOS mobile device||Chart graphics render with JSChart.||Chart graphics render with JSChart. Unsupported properties do not display.||With advanced XML, charting libraries for panels are specified at the panel level.|
Chart graphics for panels using JSChart are rendered with JSChart. JSChart-unsupported properties are ignored.
Chart graphics for panels using FlashChart are not rendered in iOS devices.
|PDF of a report or dashboard||Prints PDF using JSChart to render chart graphics.||Prints PDF using JSChart to render chart graphics. Ignores properties that are unsupported by JSChart.||PDF printing is unsupported for Advanced XML dashboards.|
For example, consider a dashboard created using simple XML that contains a panel with a line chart. If you specify a
lineStyle property that is not supported by JSChart, the chart renders without the specified property.
JSChart display issues
The JSChart charting library has some display issues that may be resolved in upcoming releases.
The JSChart library cannot render charts based on searches that do not include, or properly use, transforming search commands such as
The FlashChart charting library attempts to chart the results of non-transforming searches, but charts do not revert to FlashChart automatically for non-transforming searches. You need to explicitly specify that to use the FlashChart library in the charting XML.
JSChart can only plot time-based data using the
timechart command. If you try to plot a time-based series using any other transforming search command, JSChart treats the timestamp data as a series of strings.
FlashChart can plot time-based data with other transforming search commands.
Search result truncation
For performance reasons, the JSChart library truncates search result data sets that are too large. The exact limits that trigger this truncation depend on the browser being used as well as the charting configuration. When the JSChart library is caused to truncate data sets, it displays an error message below the chart. To remove the error message you can:
- Switch to a chart type that involves drawing only one shape per series (in other words, move from a column chart to a line chart).
- Reduce the number of fields to plot.
- For time charts, use a longer time-span between data points.
There are additional conditions that can cause truncation:
- Searches that return too many results per series can cause JSChart to hang the browser.
Splunk employs a throttling strategy that restricts the number of results returned per series to 500 by default. You can configure this value by going to
JSChart.confand changing the
maxResultsCountparameter to something other than
- JSChart can only plot the first 50 series that are returned.
Additional series are not plotted.
- Object rendering limits by charting library.
Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit, change either the search string or search time range so that the results returned fall under the limit.
- For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.
- The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. An error message displays if you reach the limit with a chart that uses JSChart.
You can override the truncation limit for charts rendered with JSChart by changing the value of the
charting.chart.resultTruncationLimitproperty on a per-chart basis. This property is only available for panels rendered with JSChart. Increasing the truncation limit can have a negative effect on dashboard performance.
You cannot change the FlashChart truncation limit of 2000 objects.
See the charting reference documentation for chart and legend properties in this manual for more information.
In JSChart, when you are plotting data on a categorical axis, no more than 80 categories can be displayed. When there are more than 80 categories, the chart does not truncate the data. Instead, the chart hides the labels and tick marks. This is not configurable. You can encoutner performance issues if you go higher than 80 categories. If you need to display a large number of axis categories, use FlashChart, which has a much higher limit.
Chart and legend properties
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15