Why is my dashboard panel only displaying data from the last 2 hours with a time range set for 24 hours in Splunk 5.0.5?

[aniketb]

I'm using Splunk enterprise 5.0.5

I have a dashboard to chart the response time of a specific transaction.

Even though I have an inline search string in a panel and have set the time range to 24 hours, the panel only charts around last 2 hours.

Is this a product limitation or does it depend on number of results?

I now have to manually run the search, export, and chart in Excel rather than exposing the dashboard to intended audience.

[woodcock]

I assume you are being limited to 10 so Edit source and change this:

<option name="count">10</option>

To this (or similar):

<option name="count">10000</option>

[pj · Accepted solution]

Could be hitting some truncation limits as outlined here:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Viz/ChartDisplayissues

[aniketb]

It's formatting the xml. I basically used:

charting.chart.resultTruncationLimit = 10000
Since my 24 hour data had around 5000 results

charting.data.count = 0

[aniketb]

Thanks,

Adding below line fixed it for me.

0

[woodcock]

It looks like your paste failed ...?

[woodcock]

You are doing something wrong but you have not given us any detail so nobody can help.

[aniketb]

What do you want woodcock?

[woodcock]

The XML for the non-working panel and the token values (usually timepicker) that cause it not to run correctly.

[aniketb]

Here's my xml:

Blockquote

Testing AB

<chart>
  <searchString>sourcetype="Apache2" AND "method=PUT" AND "my confidential data"  | rex field=Respond "^(?&lt;Response_Time&gt;\w+) " | table timestamp, Response_Time</searchString>
  <title>Testing panel</title>
  <earliestTime>-24h@h</earliestTime>
  <latestTime>-1m@m</latestTime>
  <option name="charting.axisTitleX.text">Seconds</option>
  <option name="charting.axisTitleY.text">Timestamp</option>
  <option name="charting.chart">line</option>
  <option name="charting.primaryAxisTitle.text"></option>
  <option name="charting.secondaryAxisTitle.text"></option>
  <option name="count">10</option>
  <option name="displayRowNumbers">true</option>
</chart>

Blockquote