Splunk Search

How to increase chart column number more than 3000?

Path Finder

Hi Guru,

I would like to show my data with 4000 x 3000 matrix. I used chart command but the limit for the number of columns is 100.
chart count by col1, col2 limit=0 didn't work. It shows only 100 columns.
I adjusted jschart_series_limit at web.conf to 10000000, but it didn't work. anybody knows how to remove the limit?

0 Karma


@brandy81 what is your current SPL, what is the final output for your chart? Can you share Simple XML code and sample screenshot of existing output? Please mask any sensitive information before posting.

Have you already configured all the required configuration from Splunk Documentation for Data Truncation? https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartDisplayissues#Data_truncation
PS: 4K*3K=12000000.

Are you seeing any UI warning like (based on your configuration) This visualization is configured to display a maximum of 10000 results per series? Are you using Post-Processing, Custom Visualization or seeing any Browser Console errors?

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

| stats count by col1 col2
| xyseries col1 col2 count
| noop search_optimization=false


| makeresults count=4000
| streamstats count as session
| transpose 0 header_field=session
| eval tmp=mvrange(0,3000)
| stats values(*) as * by tmp
0 Karma

Path Finder

@to4kawa Hello, Thanks, but it dose't work. xyseries also has limit for column number...

0 Karma


4000 cols can display.but matrix can't.

my answer is updated.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!