Visualizations App for Splunk Enterprise: Timelines panel does not show all the search result. Any limits?

[Shuhei052492]

Hi,

My timeline panel counts the duration of web service and shows us when the user was visiting the site.
The search result is limited to one day andhas 20,795 events and with a time span like 00:00~23:00.
When I search it at inline search, the result shows all result in a table.
But the result is limited by time-stamp of 14:00~23:00 and do not show the result of "00:00~13:59" on the timeline visualisation.

Does anyone know any solution or idea to set any limitation of .conf files?

Best regards,

[niketn · Accepted solution]

@Shuhei052492. this limit is set in the visualization itself so that it does not get more data than what it can handle. Ideally there should have been a warning displayed that "Timeline Custom Visualization can show only 10000 events. ". There is definitely provision for this in Splunk Custom Visualization API, but seems like the same is not handled. You can request a Splunk Enhancement if you feel the need and have a valid Splunk Entitlement.

Meanwhile you would need to locate the Timeline Custom Visualization App in your Splunk installation folder and edit the visualization.js file. The path should be something like following: $SPLUNK_HOME$\etc\apps\timeline_app\appserver\static\visualizations\timeline\visualization.js

Find the following piece of code and change the count value to 25000 i.e. count: 25000 and test

        getInitialDataParams: function() {
            return {
                outputMode: SplunkVisualizationBase.ROW_MAJOR_OUTPUT_MODE,
                count: 10000
            };
        },

Please try out and confirm.

[Shuhei052492]

I set the value of 25000 in visualization.js. As the result, the timeline panel show more than 10000 results.
Thank you.

[niketn]

@Shuhei052492, great!!! You would also need to document this as deployment configuration step each time you upgrade your Timeline Custom Visualization. Also check dashboard load performance before and after change.

[niketn]

@Shuhei052492, If this is for Timeline Custom Visualization the maximum number of results is set to 10000. Can you please check in stats if that is the case?

[Shuhei052492]

Yes. I asked about Timeline Custom Visualization.
I have checked in stats and the result has showed just 10000.
Is it possible to change the maximum number of results?

I have set the following setting in limits.conf, but the result have not been changed.
[search]
remote_timeline_max_count = 1000000