All Apps and Add-ons
Highlighted

Visualizations App for Splunk Enterprise: Timelines panel does not show all the search result. Any limits?

Path Finder

Hi,

My timeline panel counts the duration of web service and shows us when the user was visiting the site.
The search result is limited to one day andhas 20,795 events and with a time span like 00:00~23:00.
When I search it at inline search, the result shows all result in a table.
But the result is limited by time-stamp of 14:00~23:00 and do not show the result of "00:00~13:59" on the timeline visualisation.

Does anyone know any solution or idea to set any limitation of .conf files?

Best regards,

0 Karma
Highlighted

Re: Visualizations App for Splunk Enterprise: Timelines panel does not show all the search result. Any limits?

Legend

@Shuhei052492, If this is for Timeline Custom Visualization the maximum number of results is set to 10000. Can you please check in stats if that is the case?




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Visualizations App for Splunk Enterprise: Timelines panel does not show all the search result. Any limits?

Path Finder

Yes. I asked about Timeline Custom Visualization.
I have checked in stats and the result has showed just 10000.
Is it possible to change the maximum number of results?

I have set the following setting in limits.conf, but the result have not been changed.
[search]
remotetimelinemax_count = 1000000

0 Karma
Highlighted

Re: Visualizations App for Splunk Enterprise: Timelines panel does not show all the search result. Any limits?

Legend

@Shuhei052492. this limit is set in the visualization itself so that it does not get more data than what it can handle. Ideally there should have been a warning displayed that "Timeline Custom Visualization can show only 10000 events. ". There is definitely provision for this in Splunk Custom Visualization API, but seems like the same is not handled. You can request a Splunk Enhancement if you feel the need and have a valid Splunk Entitlement.

Meanwhile you would need to locate the Timeline Custom Visualization App in your Splunk installation folder and edit the visualization.js file. The path should be something like following: $SPLUNK_HOME$\etc\apps\timeline_app\appserver\static\visualizations\timeline\visualization.js

Find the following piece of code and change the count value to 25000 i.e. count: 25000 and test

        getInitialDataParams: function() {
            return {
                outputMode: SplunkVisualizationBase.ROW_MAJOR_OUTPUT_MODE,
                count: 10000
            };
        },

Please try out and confirm.




| eval message="Happy Splunking!!!"


View solution in original post

0 Karma
Highlighted

Re: Visualizations App for Splunk Enterprise: Timelines panel does not show all the search result. Any limits?

Path Finder

I set the value of 25000 in visualization.js. As the result, the timeline panel show more than 10000 results.
Thank you.

0 Karma
Highlighted

Re: Visualizations App for Splunk Enterprise: Timelines panel does not show all the search result. Any limits?

Legend

@Shuhei052492, great!!! You would also need to document this as deployment configuration step each time you upgrade your Timeline Custom Visualization. Also check dashboard load performance before and after change.




| eval message="Happy Splunking!!!"


0 Karma