topic Re: splunk chart issue in Splunk Search

splunk chart issue

rameshlpatel — Mon, 09 Jun 2014 20:29:33 GMT

Hi ,

In splunk, I am trying to create chart for each day (24 hrs) with span of every minute.

e.g. index="monitor" source=* | timecart span=1m avg(time)

but to do this its giving following msg :

These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached.

somesoni2 — Mon, 09 Jun 2014 20:39:38 GMT

See this

sloshburch — Fri, 29 Jan 2016 14:43:59 GMT

If you turn this into a dashboard, you can use the charting.data.count option to set a higher limit (even unlimited (0) if you're feeling dangerous).
http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference