"These results may be truncated. Your search generated too much data for the current visualization configuration."

[akanno]

Hi, splunk community.

I get following message in panel.

"These results may be truncated. Your search generated too much data for the current visualization configuration."

I have bothered that the results is truncated.

then I tried to use flash chart.

It's because if you need to display a large number of axis categories, use FlashChart, in below manual

http://docs.splunk.com/Documentation/Splunk/6.1.4/AdvancedDev/CustomChartingConfig-JSChart

and so I set in web.conf

simple_xml_force_flash_charting = true

However,the results is truncated.

Is there a way to solve?

[sansay · Accepted solution]

Truncation will always happen if your query generates more points than FlashChart can handle. Per the document you are referring to, the maximum number of points it can handle is 2000.
All you need to do is reduce the resolution of your chart. For example, if you have a chart that returns a single line data points for 2 days, a "span=1m" will result in 1440 min/day * 2 = 2880 points.
In that case, use "span=5m", and you will get 2880/5 = 576 points, and you will not get your data truncated.

Like I said in my answer to your comments, you will have to use FlashChart in advanced XML.
Here is a quickly put together test dashboard which doesn't truncate the results of your query.

<view autoCancelInterval="90" isVisible="true"  objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <label>TEST</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="maxSize">1</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="filter">*</param>
  </module>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>    
  <module name="Message" layoutPanel="navigationHeader">
    <param name="level">warn</param>
    <param name="maxSize">1</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="filter">splunk.search.job</param>
  </module>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="test" autoRun="True">
    <param name="groupLabel">test</param>
    <param name="search">earliest=-60m index=_internal | timechart span=1m count by component useother=f limit=0</param>
    <module name="ViewstateAdapter">
      <module name="HiddenFieldPicker">
        <param name="strictMode">True</param>
        <module name="JobProgressIndicator">
          <module name="EnablePreview">
            <param name="display">False</param>
            <param name="enable">True</param>
            <module name="HiddenChartFormatter">
              <param name="charting.chart">line</param>    
              <param name="charting.axisTitleX.text"></param>                              
              <param name="charting.legend.placement">top</param>
              <module name="FlashChart">
                <param name="width">100%</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="ViewRedirector">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>
              <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

[akanno]

I understand that I can not use FlashChart unless I use Advanced XML.

Thank you very much.

[akanno]

index=_internal | timechart span=10m count by component useother=f limit=0

please try this command at last 60 min.

I seem that this command is about 62 line * 60min/10min = 372 points

However I got the message that "These results may be truncated. Your search generated too much data for the current visualization configuration."

[sansay]

Ah sorry but I didn't realize this little detail:
" Simple XML does not support Flash charts. A Flash chart referenced in simple XML does not display."
which I found in this doc:
http://docs.splunk.com/Documentation/Splunk/6.1.3/AdvancedDev/CustomChartingConfig-JSChart

This contradicts the possibility of the "simple_xml_force_flash_charting" setting being effective.

Anyway, running your query in the search app (which uses JSChart) did truncate. This query returns 60 series.But I also found the following:
1. increasing the time span didn't help at all, even if set to 30 minutes.
2. decreasing the number of series down to 47 stopped the truncation, even with the span set to 1 minute.
This tells us that there is a hard limit set in the JSChart.conf. Then I searched some more and found this: " JSChart can only plot the first 50 series that are returned.
Additional series are not plotted. "
I think there are just too many limits in JSChart.
I would highly recommend that you go to Advanced XML. This way you can tell it to use FlashChart.