topic How do I prevent my chart results from being truncated? in Splunk Search

How do I prevent my chart results from being truncated?

akazarov — Thu, 03 Dec 2015 18:06:48 GMT

Hello all,

I've seen a few similar discussions, but neither solution works for me - sorry for raising this again.

I have a search and a chart which produces big amount of results, and to plot it I use limiter
bins=2000 in my chart command. Yes, I want to display more then 1000 points on my UHD screen. But whatever chart options I use, it still complains with famous:

These results may be truncated. Your search generated too much data for the current visualization configuration.

and indeed the results are not complete. What I have in my chart XML code:

<option name="charting.data.count">3000</option>
<option name="charting.chart.resultTruncationLimit">3000</option>

Is there a working option? I could not find anything relevant in limits.conf. My splunk version is 6.3.0.

Thanks!

Re: How do I prevent my chart results from being truncated?

jplumsdaine22 — Fri, 04 Dec 2015 13:49:37 GMT

Have you seen: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/ChartDisplayissues

Your code looks right, can you post the full XML? it may be that your tag is in the wrong spot. Also put your search string if possible

Re: How do I prevent my chart results from being truncated?

kbecker — Thu, 29 Sep 2016 15:12:02 GMT

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this.

Thanks,
Ken

Re: How do I prevent my chart results from being truncated?

akazarov — Mon, 03 Oct 2016 14:49:29 GMT

I think this was resolved in the newer releases following 6.3.0.