Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Chart display issues

This topic covers display issues using chart visualizations.

Searches with non-transforming commands

You cannot render charts using searches that do not include transforming commands, such as the following options.

chart
timechart
stats
eval

For more information on transforming commands, see About Transforming commands and searches.

Time charting

You can only plot time-based data using the timechart command. If you try to plot a time-based series using any other transforming search command, the chart treats the timestamp data as a series of strings.

Search result truncation

The Splunk platform employs a throttling strategy that restricts the number of results returned per series. The default value restricts results per series to the first 1000 results. When a chart reaches this limit it displays a message indicating the results have been truncated.

You can override the default value in Simple XML code for the chart using the charting.data.count property. See General chart properties in the Chart Configuration Reference for details.

Limits on the number of points that can be plotted

To avoid negatively impacting web browser performance, Splunk software limits the number of points that can be plotted for an individual chart. The limits that trigger this truncation of data vary, depending on the web browser.

When a chart displays a truncated data set it displays a message below the chart indicating that results are truncated.

The following table indicates default truncation limits by browser.

Browser Maximum points plotted
Chrome 20000
Firefox 20000
Safari 20000
Internet Explorer 7 or 8 2000
Internet Explorer 9, 10, and 11 20000

You can override these limits using one of the following options.

Configure a limit that is enforced across all browsers

The web.conf configuration file specifies the maximum number of points that can be plotted for different browsers. To override the per browser settings, uncomment and edit the following web.confsetting to define the limit for all browsers.

jschart_truncation_limit = 20000

Configure a limit per chart

You can configure the maximum number of points that can be plotted for a specific chart by editing the Simple XML for the chart. In the <chart> element, edit the charting.chart.resultTruncationLimit property as described in Area, bar, column, line, and scatter charts in the Chart Configuration Reference.

Category limit

When you are plotting data by category, Splunk software limits chart label display. This limit differs for the horizontal axis (X-axis) and the vertical axis (Y-axis).

The X-axis must have at least 20 pixels available for each label. The Y-axis must have at least 15 pixels available. If the requisite pixels are not available, the labels do not display.

You can zoom into the X-axis to view labels that are hidden by the category limit. See Pan and zoom chart controls for details.

PREVIOUS
Chart controls
  NEXT
Mapping data

This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters