topic Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5? in Dashboards & Visualizations

Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

aniketb — Tue, 10 May 2016 17:20:08 GMT

I'm using Splunk enterprise 5.0.5

I have a dashboard to chart the response time of a specific transaction.

Even though I have an inline search string in a panel and have set the time range to 24 hours, the panel only charts around last 2 hours.

Is this a product limitation or does it depend on number of results?

I now have to manually run the search, export, and chart in Excel rather than exposing the dashboard to intended audience.

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

woodcock — Tue, 10 May 2016 17:23:13 GMT

You are doing something wrong but you have not given us any detail so nobody can help.

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

aniketb — Tue, 10 May 2016 17:27:25 GMT

What do you want woodcock?

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

woodcock — Tue, 10 May 2016 17:31:39 GMT

The XML for the non-working panel and the token values (usually timepicker) that cause it not to run correctly.

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

pj — Tue, 10 May 2016 17:38:55 GMT

Could be hitting some truncation limits as outlined here:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Viz/ChartDisplayissues

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

aniketb — Tue, 10 May 2016 17:40:24 GMT

Here's my xml:

Blockquote

Testing AB

<chart>
  <searchString>sourcetype="Apache2" AND "method=PUT" AND "my confidential data"  | rex field=Respond "^(?&lt;Response_Time&gt;\w+) " | table timestamp, Response_Time</searchString>
  <title>Testing panel</title>
  <earliestTime>-24h@h</earliestTime>
  <latestTime>-1m@m</latestTime>
  <option name="charting.axisTitleX.text">Seconds</option>
  <option name="charting.axisTitleY.text">Timestamp</option>
  <option name="charting.chart">line</option>
  <option name="charting.primaryAxisTitle.text"></option>
  <option name="charting.secondaryAxisTitle.text"></option>
  <option name="count">10</option>
  <option name="displayRowNumbers">true</option>
</chart>

Blockquote

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

woodcock — Tue, 10 May 2016 17:51:57 GMT

I assume you are being limited to 10 so Edit source and change this:

<option name="count">10</option>

To this (or similar):

<option name="count">10000</option>

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

aniketb — Tue, 10 May 2016 18:25:08 GMT

Thanks,

Adding below line fixed it for me.

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

woodcock — Tue, 10 May 2016 18:30:17 GMT

It looks like your paste failed ...?

Re: Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

aniketb — Tue, 10 May 2016 18:48:16 GMT

It's formatting the xml. I basically used:

charting.chart.resultTruncationLimit = 10000
Since my 24 hour data had around 5000 results

charting.data.count = 0