Splunk® Enterprise

Dashboards and Visualizations

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Chart display issues

This topic covers display issues using chart visualizations.

Searches with non-transforming commands

You cannot render charts using searches that do not include transforming commands, such as the following options.


For more information on transforming commands, see About Transforming commands and searches.

Time charting

You can only plot time-based data using the timechart command. If you try to plot a time-based series using any other transforming search command, the chart treats the timestamp data as a series of strings.

Search result truncation

The Splunk platform employs a throttling strategy that restricts the number of results returned per series. The default value restricts results per series to the first 1000 results. When a chart reaches this limit it displays a message indicating the results have been truncated.

You can override the default value in Simple XML code for the chart using the charting.data.count property. See General chart properties in the Chart Configuration Reference for details.

Limits on the number of points that can be plotted

To avoid negatively impacting web browser performance, Splunk software limits the number of points that can be plotted for an individual chart to 50,000. When a chart displays a truncated data set it displays a message below the chart indicating that results are truncated.

You can override default data or data series truncation settings.

Configure a data point rendering limit for one chart

You can configure the maximum number of points that can be plotted for a specific chart by editing the Simple XML for the chart. In the <chart> element, edit the charting.chart.resultTruncationLimit property as described in Area, bar, column, line, and scatter charts in the Chart Configuration Reference.

Configure a data point rendering limit for all charts

The web.conf configuration file specifies the maximum number of points that can be plotted for different browsers. To override the per browser settings, uncomment and edit the following web.confsetting to define the limit for all browsers.

jschart_truncation_limit = 20000

The charting.chart.resultTruncationLimit Simple XML option overrides this limit in individual charts.

Category limit

When you are plotting data by category, Splunk software limits chart label display. This limit differs for the horizontal axis (X-axis) and the vertical axis (Y-axis).

The X-axis must have at least 20 pixels available for each label. The Y-axis must have at least 15 pixels available. If the requisite pixels are not available, the labels do not display.

You can zoom into the X-axis to view labels that are hidden by the category limit. See Pan and zoom chart controls for details.

Last modified on 11 November, 2016
Bubble chart

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters