Chart display issues
This topic covers display issues using chart visualizations.
Searches with non-transforming commands
You cannot render charts using searches that do not include transforming commands, such as the following options.
chart
timechart
stats
eval
For more information, see About Transforming commands and searches in the Search Manual.
Time charting
You can only plot time-based data using the timechart
command, which generates the _time
based output. If you try to plot a time-based series using any other transforming search command, or rename the _time
value, the chart treats the timestamp data as a series of strings.
Data truncation
To avoid browser performance impacts, Splunk software limits the the amount of data rendered in an individual chart. When search results exceed limits, a message appears with the chart indicating that data was truncated.
Depending on your Splunk instance type and dashboard editing permissions, you can change default rendering behavior using configuration settings and Simple XML.
Users with editing permissions can modify Simple XML data truncation settings for individual charts in a dashboard.
Splunk Enterprise administrators can also add or edit local copies of visualizations.conf
and web.conf
to configure truncation settings for charts across a Splunk deployment.
Use the following table to compare configuration options.
Rendering limit type | In | Setting | Default | Where to configure |
---|---|---|---|---|
Total data points | One chart in a dashboard | charting.chart.resultTruncationLimit
|
50000 | Simple XML |
Data points per series | One chart in a dashboard | charting.data.count
|
10000 | Simple XML |
Data points per series | One chart type | data_sources.primary.params.count Replaces the deprecated jschart_results_limit setting in web.conf .When set to a numeric value, overrides charting.data.count Simple XML setting in charts of this type.
|
1000 | visualizations.conf
|
Total data points | All charts in all browsers | jschart_truncation_limit
|
No default. Specify to override individual browser settings. | web.conf
|
Total data points | Charts in an individual browser | One or more of the following settings.
|
50000 | web.conf
|
Data series | All charts | jschart_series_limit
|
100 | web.conf
|
Simple XML data truncation options
You can adjust data truncation in individual charts using Simple XML.
Data point limit for one chart
You can configure the maximum number of points that can be plotted in a specific chart by editing the Simple XML for the chart. In the <chart>
element, edit the charting.chart.resultTruncationLimit
property as described in Area, bar, column, line, and scatter charts in the Chart Configuration Reference.
Data point limit per series in one chart
You can limit the number of search result data points rendered per series in a chart. Edit the charting.data.count
Simple XML setting to override the default value of 10000 data series.
Configuration file data truncation settings
Splunk Enterprise admins can add or edit truncation settings in $SPLUNK_HOME$/etc/system/local/web.conf
or $SPLUNK_HOME$/etc/system/local/visualizations.conf
.
Data point limit for all charts in one or more browsers
The web.conf
configuration file specifies the maximum number of points that can be plotted for charts in various browsers. All browser limits default to 50000 data points.
You can override individual browser settings or add a jschart_truncation_limit
setting in $SPLUNK_HOME$/etc/system/local/web.conf
to define a limit for all browsers. The jschart_truncation_limit
overrides any individual browser settings.
Note: The charting.chart.resultTruncationLimit
Simple XML option overrides this limit in an individual chart.
Data series limit for all charts
You can limit the number of data series that charts can render. Add or edit the jschart_series_limit
setting in $SPLUNK_HOME$/etc/system/local/web.conf
to override the default value of 100 data series.
If search results exceed this limit, a chart displays only the number of series that this limit allows. A warning message appears to indicate that the chart is showing truncated search results. For example, if the jschart_series_limit
is 40 and a search returns 50 data series, a chart renders only the first 40 series.
Data point limit per series for one chart type
Limit the number of search result data points rendered per series in a specific chart type. Edit the data_sources.primary.params.count
setting in visualizations.conf
to override the default value of 1000 result rows.
For example, you can set the data point limit per series in pie charts. Edit the [pie]
chart type stanza in $SPLUNK_HOME$/etc/system/local/visualizations.conf
:
[pie] data_sources.primary.params.count = 10
As of the latest software version, the web.conf
jschart_results_limit
data point per series setting for all charts is deprecated. Use data_sources.primary.params.count
instead.
Data series and data point limit precedence
In the case of an individual chart, if the jschart_series_limit
and the charting.data.count
Simple XML options combine to indicate a number greater than the jschart_truncation_limit
in web.conf
, then data points per series are reduced to meet the jschart_truncation_limit
setting.
For example, you might have a jschart_series_limit
of 10 and a charting.data.count
limit of 100 in a chart. When multiplied, these two settings indicate a 1000 total data point limit for the chart. If the js_chart_truncation_limit
is 800, however, then data points per series are reduced to meet the 800 total point limit.
To override the js_chart_truncation
limit on all charts, you can use charting.chart.resultTruncationLimit
Simple XML option to change the limit for an individual chart.
About editing configuration files
For more information about working with the web.conf
and visualizations.conf
configuration files, see the following topics in the Admin Manual.
Category limit
When you are plotting data by category, Splunk software limits chart label display. This limit differs for the horizontal axis (X-axis) and the vertical axis (Y-axis).
The X-axis must have at least 20 pixels available for each label. The Y-axis must have at least 15 pixels available. If the requisite pixels are not available, the labels do not display.
You can zoom into the X-axis to view labels that are hidden by the category limit. See Pan and zoom chart controls for details.
Event annotations for charts | Overview |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1, 8.1.0, 8.1.10, 8.1.11, 8.1.12
Feedback submitted, thanks!