This visualization is configured to display a maximum of 1000 results per series

[wcleong]

hi, I have following problem when creating a scatter chart, the search returned >1000 entries, how can I increase the maximum results of the graph??

I got this message.
This visualization is configured to display a maximum of 1000 results per series

I have modified JSChart.conf but it seems to be not working.

[ers81239]

I know this question is ancient, but I was just dealing with this problem trying to show a line graph for the stats reported by the TA for Unix. I was able to solve the 1000 results per series issue and also get better control over which stats are displayed by explicitly using a timechart command. So my search string went from:

`os_index` `cpu_sourcetype` all

to:

`os_index` `cpu_sourcetype` all  | timechart avg(pctIowait), avg(pctSystem), avg(pctUser)

I think that in this case, the timechart command does the aggregation by time which winds up sending less data points to the graph itself.

[yannK]

The setting is looking at charting.chart.data.count at the maximum limit of events to retrieve, and the default is 1000.
see http://docs.splunk.com/Documentation/Splunk/6.2.1/AdvancedDev/AdvChartingConfig-LayoutData#Timeline_...

Can you try adding this parameter with a higher limit and retry ?

`< option name="charting.data.count" >9999</ option >

`this works on simple XML

[jtrucks]

Does this help?

http://answers.splunk.com/answers/10349/chart-only-showing-1000-events

[martin_mueller]

You're likely better off modifying your search to yield less than 1000 results.