topic Why is my line chart incomplete? in Splunk Enterprise

Why is my line chart incomplete?

VEkhardt — Tue, 23 Aug 2022 14:03:51 GMT

We are using Splunk Enterprise Ver.:8.2.3

and currently solving a Issue with displaying Line chart.

The Use of the "search" and visualizing it into a line chart works properly

with time range from 20:00 to 20:30 with span=1m

but not with time range from 20:00 to 21:00 and span=1m

time range 20:00-20:30

line charts looks ok with time range 20:00-20:30

in dashboard looks line chart ok as wellwith time range 20:00-20:30

but in this case with time range 20:00-21:00 in dashboard the line chart is incomplete, there is 13 mins a gap with 0

here you cans see 13mins gap and we don't know why, because we have events to display.

events with time range 20:00-21:00 looks ok

The search is working properly here but not in dashboard.

Can you explain me this weird behavior and where is the Issue please?

Thank you in advance

Re: Why is my line chart incomplete?

bowesmana — Tue, 23 Aug 2022 23:22:53 GMT

This looks a little odd in that the dashboard chart shows missing plot info, but the visualisation in search shows all the plot data...

Normally I would suggest it's a max data point issue, but as it's visible in the search viz, that doesn't make total sense.

If you make the 1 hour window use span=2m, do you get all the data points visible?

If so, I suspect it's a data point issue showing the trellis.

Can you validate the dashboard data by adding a <table> row/panel using the timechart search as the base search, so it will show the raw results as well as the chart, just to confirm that it's getting all the data in the dashboard.

Is there anything in the browser's dev tools console? Is it the same with another browser?

Re: Why is my line chart incomplete?

VEkhardt — Thu, 10 Nov 2022 16:21:13 GMT

The Issue was in "base search" which was limiting my search on 500k events and the line chart as well.