Chart display issues
This topic covers display issues using chart visualizations.
Searches with non-transforming commands
You cannot render charts using searches that do not include transforming commands, such as the following options.
For more information on transforming commands, see About Transforming commands and searches.
You can only plot time-based data using the
timechart command. If you try to plot a time-based series using any other transforming search command, the chart treats the timestamp data as a series of strings.
Search result truncation
The Splunk platform employs a throttling strategy that restricts the number of results returned per series. The default value restricts results per series to the first 1000 results. When a chart reaches this limit it displays a message indicating the results have been truncated.
You can override the default value in Simple XML code for the chart using the
charting.data.count property. See General chart properties in the Chart Configuration Reference for details.
Limits on the number of points that can be plotted
To avoid negatively impacting web browser performance, Splunk software limits the number of points that can be plotted for an individual chart. The limits that trigger this truncation of data vary, depending on the web browser.
When a chart displays a truncated data set it displays a message below the chart indicating that results are truncated.
The following table indicates default truncation limits by browser.
|Browser||Maximum points plotted|
|Internet Explorer 7 or 8||2000|
|Internet Explorer 9, 10, and 11||20000|
You can override these limits using one of the following options.
Configure a limit that is enforced across all browsers
web.conf configuration file specifies the maximum number of points that can be plotted for different browsers. To override the per browser settings, uncomment and edit the following
web.confsetting to define the limit for all browsers.
jschart_truncation_limit = 20000
Configure a limit per chart
You can configure the maximum number of points that can be plotted for a specific chart by editing the Simple XML for the chart. In the
<chart> element, edit the
charting.chart.resultTruncationLimit property as described in Area, bar, column, line, and scatter charts in the Chart Configuration Reference.
When you are plotting data by category, Splunk software limits chart label display. This limit differs for the horizontal axis (X-axis) and the vertical axis (Y-axis).
The X-axis must have at least 20 pixels available for each label. The Y-axis must have at least 15 pixels available. If the requisite pixels are not available, the labels do not display.
You can zoom into the X-axis to view labels that are hidden by the category limit. See Pan and zoom chart controls for details.
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11