Chart display issues

This topic covers display issues using chart visualizations.

Searches with non-transforming commands

You cannot render charts using searches that do not include transforming commands, such as the following options.

chart

timechart

stats

eval

For more information on transforming commands, see About Transforming commands and searches.

Time charting

You can only plot time-based data using the timechart command. If you try to plot a time-based series using any other transforming search command, the chart treats the timestamp data as a series of strings.

Search result truncation

The Splunk platform employs a throttling strategy that restricts the number of results returned per series. The default value restricts results per series to the first 1000 results. When a chart reaches this limit it displays a message indicating the results have been truncated.

You can override the default value in Simple XML code for the chart using the charting.data.count property. See General chart properties in the Chart Configuration Reference for details.

Limits on the number of points that can be plotted

To avoid negatively impacting web browser performance, Splunk software limits the number of points that can be plotted for an individual chart. The limits that trigger this truncation of data vary, depending on the web browser.

When a chart displays a truncated data set it displays a message below the chart indicating that results are truncated.

The following table indicates default truncation limits by browser.

Browser	Maximum points plotted
Chrome	20000
Firefox	20000
Safari	20000
Internet Explorer 7 or 8	2000
Internet Explorer 9, 10, and 11	20000

You can override these limits using one of the following options.

Configure a limit that is enforced across all browsers

The web.conf configuration file specifies the maximum number of points that can be plotted for different browsers. To override the per browser settings, uncomment and edit the following web.confsetting to define the limit for all browsers.

jschart_truncation_limit = 20000

Configure a limit per chart

You can configure the maximum number of points that can be plotted for a specific chart by editing the Simple XML for the chart. In the <chart> element, edit the charting.chart.resultTruncationLimit property as described in Area, bar, column, line, and scatter charts in the Chart Configuration Reference.

Category limit

When you are plotting data by category, Splunk software limits chart label display. This limit differs for the horizontal axis (X-axis) and the vertical axis (Y-axis).

The X-axis must have at least 20 pixels available for each label. The Y-axis must have at least 15 pixels available. If the requisite pixels are not available, the labels do not display.

You can zoom into the X-axis to view labels that are hidden by the category limit. See Pan and zoom chart controls for details.