topic Re: Splunk JSChart truncation message not being displayed in Dashboards & Visualizations

Splunk JSChart truncation message not being displayed

alanfinlay — Tue, 03 Sep 2013 01:53:47 GMT

According to the documentation, an error message should be displayed when exceeding the 1000 or 2000 object limit for charts rendered by JSChart. I have not seen this error message using Firefox (23.0.1) or IE (9.0.8112.16421 64 bit). Is this a browser issue?

When I look at the source HTML I do see code for a message, but it is not displayed, and that code is present even when there is no truncation:

<div class="JSChartContainer" style="width:100%; height:333px;"></div> <div class="inlineMessageContainer" style="display: none;">
    <p class="resultStatusMessage">
        <span class="inlineMessage">
            Search generated too much data for the current display configuration, results have been truncated.
            <span class="resultStatusHelp">
                <a href="/en-US/help?location=learnmore.charting.datatruncation" target="_blank" title="Splunk help" class="spl-external-link spl-icon-external-link-xsm">Learn More</a> 
            </span>
        </span>
    </p> </div>
    </div>

Re: Splunk JSChart truncation message not being displayed

nmistry_splunk — Tue, 03 Sep 2013 06:42:08 GMT

Dont worry, you may have not hit the limit yet!

The notice is hidden by default, using style="display: none;" attribute, and when you will hit the limit, javascript will drop that attribute and make the block visible.

You could run the following search as a test: index=_internal | stats count(*) by _time

Re: Splunk JSChart truncation message not being displayed

alanfinlay — Tue, 03 Sep 2013 07:12:21 GMT

Maybe I am confused about what triggers this message. I have a timeseries chart (line) for 7 days of results and I only see the first 5 days if I pick results per 15 mins = 672. So it seems there is a 500 time point limit somewhere.

sourcetype="Perfmon:CPU Load" counter="% Processor Time" | timechart span=15m avg(Value)

Re: Splunk JSChart truncation message not being displayed

nmistry_splunk — Tue, 03 Sep 2013 08:37:14 GMT

I see. The issue is overflow on the x-axis does not alert the user. The issue here is the size of the chart of smaller than the actual number of points it tries to plot on it. For example: you size of the chart is 500px, but the sum of all the points you are tying to plot is 800px. As a result, you can see the first 500px but the remaining 300px are hidden.

Re: Splunk JSChart truncation message not being displayed

nmistry_splunk — Tue, 03 Sep 2013 08:37:19 GMT

As a workaround -
1. Try to ensure such charts on dashboard have a row by themselves. This will allow the chart to cover as much width as it can. For ex. expand the 500px to 600px.
2. Reduce the number of points you are plotting by increasing the span from 15m to say 30m.

This is a bug, and we will work on improving the messaging.

Re: Splunk JSChart truncation message not being displayed

Karunamon — Wed, 04 Sep 2013 14:11:53 GMT

Are there any plans to raise the number of events that can be graphed?