How do I prevent my chart results from being truncated?

[akazarov]

Hello all,

I've seen a few similar discussions, but neither solution works for me - sorry for raising this again.

I have a search and a chart which produces big amount of results, and to plot it I use limiter
bins=2000 in my chart command. Yes, I want to display more then 1000 points on my UHD screen. But whatever chart options I use, it still complains with famous:

These results may be truncated. Your search generated too much data for the current visualization configuration.

and indeed the results are not complete. What I have in my chart XML code:

<option name="charting.data.count">3000</option>
<option name="charting.chart.resultTruncationLimit">3000</option>

Is there a working option? I could not find anything relevant in limits.conf. My splunk version is 6.3.0.

Thanks!

[akazarov · Accepted solution]

I think this was resolved in the newer releases following 6.3.0.

[kbecker]

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this.

Thanks,
Ken

[jplumsdaine22]

Have you seen: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/ChartDisplayissues

Your code looks right, can you post the full XML? it may be that your tag is in the wrong spot. Also put your search string if possible