topic Max data points that charts can handle? in Splunk Search

Max data points that charts can handle?

melonman — Wed, 30 Jan 2013 06:09:59 GMT

Hi,

I am looking for the chart property to control the max number of data points that a chart can handle.
There are some posts in Answers related to this topic but I still can not find the configuration parameter for this.

I would appreciate if anyone could point me to the information about this.

Thank you all in advance.

Re: Max data points that charts can handle?

yannK — Wed, 30 Jan 2013 07:29:19 GMT

see http://docs.splunk.com/Documentation/Splunk/5.0.1/Viz/CustomChartingConfig-JSChart#Search_result_truncation

Object rendering limits by charting library. Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit you'll want to change either the search string or search time range so that the results returned fall under the limit.

For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.
The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. If you hit the limit with a chart that uses JSChart, Splunk provides an error message

Note: You can override the truncation limit for charts rendered with JSChart by changing the value of the charting.chart.resultTruncationLimit property on a per-chart basis. Note that this property is only available for panels rendered with JSChart. Also, be aware that increasing this truncation limit can have a negative effect on dashboard performance.

You can't change the FlashChart truncation limit of 2000 objects

Re: Max data points that charts can handle?

melonman — Wed, 30 Jan 2013 08:42:48 GMT

Thank you!

Re: Max data points that charts can handle?

davidpaper — Thu, 18 Apr 2013 17:25:44 GMT

Hi,

To expand on yannK's answer excellent, there appears to be 2 config items in JSChart that would affect this, and they both live in $SPLUNK/share/splunk/search_mrsparkle/modules/results/flash/JSChart.conf.

1) [param:maxResultCount]
required = False
default = 500

I changed this to:

default = 5000

to allow jschart to pull in more data points per series.

2) [param:resultTruncationLimit]
required = False
default = 0

change this to something other than 0, so that for EVERY JSChart that gets rendered, it gets the benefit of the higher limit, instead of having to put that xml setting change in for every panel.

I set default = 20000 and at least with Google Chrome as the browser, it has no problems.

Hope this helps.

Re: Max data points that charts can handle?

hexx — Thu, 18 Apr 2013 21:37:21 GMT

Nice one. Do note, however, that this customization is not upgrade-resilient and will need to be re-applied every time Splunk is upgraded.

Re: Max data points that charts can handle?

linu1988 — Wed, 14 May 2014 14:06:44 GMT

Can i change this config specific to one app?

Re: Max data points that charts can handle?

davidpaper — Wed, 14 May 2014 14:14:04 GMT

No. This is a server-wide config, and can't be set per app.

Re: Max data points that charts can handle?

melonman — Tue, 27 May 2014 04:27:31 GMT

Now I am using this to plot timechart count span=1s for 1hour data.
This is for per-chart config in simple XML.

<option name="charting.data.count">4000</option>
<option name="charting.chart.resultTruncationLimit">3000</option>

Re: Max data points that charts can handle?

melonman — Tue, 27 May 2014 04:33:26 GMT

http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/ChartConfigurationReference

charting.data.count

The number of results to retrieve. Set to 0 to get all results.

charting.chart.resultTruncationLimit

Override default rendering limits for the total number of objects plotted in a chart. These apply to cartesian (dual axis) charts.

column: 1200
bar: 1200
line: 2000
area: 2000

Re: Max data points that charts can handle?

akazarov — Thu, 19 May 2016 13:21:52 GMT

For me, charting.chart.resultTruncationLimit works with splunk 6.3.3 and does NOT work with 6.3.0.

Re: Max data points that charts can handle?

akazarov — Thu, 19 May 2016 13:51:32 GMT

For me these 2 settings has no effect. What is important is to have NofBins * NofSeries < charting.chart.resultTruncationLimit in the chart.