Splunk® Enterprise

Dashboards and Visualizations

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. Click here for the latest version.
Acrobat logo Download topic as PDF

Chart display issues

This topic covers display issues using chart visualizations.

Searches with non-transforming commands

You cannot render charts using searches that do not include transforming commands, such as the following options.


For more information, see About Transforming commands and searches in the Search Manual.

Time charting

You can only plot time-based data using the timechart command. If you try to plot a time-based series using any other transforming search command, the chart treats the timestamp data as a series of strings.

Data truncation

To avoid browser performance impacts, Splunk software limits the the amount of data rendered in an individual chart. When search results exceed limits, a message appears with the chart indicating that data was truncated.

Depending on your Splunk instance type, you can change default rendering behavior using configuration settings and/or Simple XML. You can adjust Simple XML options in individual charts. Splunk Enterprise administrators can also add or edit settings for all charts in the $SPLUNK_HOME$/etc/system/local/web.conf file.

Use the following table to compare limit configuration options.

Rendering limit type In Setting Default Where to configure
Total data points One chart charting.chart.resultTruncationLimit 50000 Simple XML
Data points per series One chart charting.data.count 10000 Simple XML
Total data points All charts in all browsers jschart_truncation_limit No default. Specify to override individual browser settings. web.conf
Total data points Charts in an individual browser One or more of the following settings.
  • jschart_truncation_limit.chrome
  • jschart_truncation_limit.safari
  • jschart_truncation_limit.firefox
  • jschart_truncation_limit.ie11
50000 web.conf
Data series All charts jschart_series_limit 100 web.conf
Data points per series All charts jschart_results_limit 10000 web.conf

Simple XML data truncation options

You can adjust data truncation in individual charts using Simple XML.

Data point limit for one chart

You can configure the maximum number of points that can be plotted in a specific chart by editing the Simple XML for the chart. In the <chart> element, edit the charting.chart.resultTruncationLimit property as described in Area, bar, column, line, and scatter charts in the Chart Configuration Reference.

Data point limit per series in one chart

You can limit the number of search result data points rendered per series in a chart. Edit the charting.data.count Simple XML setting to override the default value of 10000 data series.

Configuration file data truncation settings

Splunk Enterprise users can add or edit settings in $SPLUNK_HOME$/etc/system/local/web.conf to change rendering behavior in all charts.

For information about editing web.conf settings, see How to edit a configuration file and the web.conf spec file in the Admin Manual.

Data point limit for all charts in one or more browsers

The web.conf configuration file specifies the maximum number of points that can be plotted for charts in various browsers. All browser limits default to 50000 data points.

You can override individual browser settings or add a jschart_truncation_limit setting in $SPLUNK_HOME$/etc/system/local/web.conf to define a limit for all browsers. The jschart_truncation_limit overrides any individual browser settings.

Note: The charting.chart.resultTruncationLimit Simple XML option overrides this limit in an individual chart.

Data series limit for all charts

You can limit the number of data series that charts can render. Add or edit the jschart_series_limit setting in $SPLUNK_HOME$/etc/system/local/web.conf to override the default value of 100 data series.

If search results exceed this limit, a chart displays only the number of series that this limit allows. A warning message appears to indicate that the chart is showing truncated search results. For example, if the jschart_series_limit is 40 and a search returns 50 data series, a chart renders only the first 40 series.

Data point limit per series for all charts

Limit the number of search result data points rendered per series in all charts. Edit the jschart_results_limit setting in $SPLUNK_HOME$/etc/system/local/web.conf to override the default value of 10000 data series.

Data series and data point limit precedence

In the case of an individual chart, if the jschart_series_limit and the charting.data.count Simple XML options combine to indicate a number greater than the jschart_truncation_limit in web.conf, then data points per series are reduced to meet the jschart_truncation_limit setting.

For example, you might have a jschart_series_limit of 10 and a charting.data.count limit of 100 in a chart. When multiplied, these two settings indicate a 1000 total data point limit for the chart. If the js_chart_truncation_limit is 800, however, then data points per series are reduced to meet the 800 total point limit.

To override the js_chart_truncation limit on all charts, you can use charting.chart.resultTruncationLimit Simple XML option to change the limit for an individual chart.

Category limit

When you are plotting data by category, Splunk software limits chart label display. This limit differs for the horizontal axis (X-axis) and the vertical axis (Y-axis).

The X-axis must have at least 20 pixels available for each label. The Y-axis must have at least 15 pixels available. If the requisite pixels are not available, the labels do not display.

You can zoom into the X-axis to view labels that are hidden by the category limit. See Pan and zoom chart controls for details.

Last modified on 16 June, 2017
Bubble chart

This documentation applies to the following versions of Splunk® Enterprise: 6.5.7

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters