Splunk Search

How to increase chart column number more than 3000?

brandy81
Path Finder

Hi Guru,

I would like to show my data with 4000 x 3000 matrix. I used chart command but the limit for the number of columns is 100.
chart count by col1, col2 limit=0 didn't work. It shows only 100 columns.
I adjusted jschart_series_limit at web.conf to 10000000, but it didn't work. anybody knows how to remove the limit?

0 Karma

niketnilay
Legend

@brandy81 what is your current SPL, what is the final output for your chart? Can you share Simple XML code and sample screenshot of existing output? Please mask any sensitive information before posting.

Have you already configured all the required configuration from Splunk Documentation for Data Truncation? https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartDisplayissues#Data_truncation
PS: 4K*3K=12000000.

Are you seeing any UI warning like (based on your configuration) This visualization is configured to display a maximum of 10000 results per series? Are you using Post-Processing, Custom Visualization or seeing any Browser Console errors?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

to4kawa
SplunkTrust
SplunkTrust
...
| stats count by col1 col2
| xyseries col1 col2 count
| noop search_optimization=false

sample:

| makeresults count=4000
| streamstats count as session
| transpose 0 header_field=session
| eval tmp=mvrange(0,3000)
| stats values(*) as * by tmp
0 Karma

brandy81
Path Finder

@to4kawa Hello, Thanks, but it dose't work. xyseries also has limit for column number...

0 Karma

to4kawa
SplunkTrust
SplunkTrust

4000 cols can display.but matrix can't.

my answer is updated.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!