Splunk Search

How to set the maximum number of displayed values in a chart in Splunk 6.3?

gschr
Path Finder

Hi,

The following dashboard contains a search that returns more than 1000 values (3600). I want to visualize all of them, but there is a maximum number of values a Splunk chart can display. The option <option name="charting.data.count">0</option> is supposed to raise this limit or deactivate it (http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/ChartConfigurationReference).

This option doesn't seem to have effect on the Dashboard in Splunk 6.3.

<dashboard>
  <label>Test charting.data.count</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index="_internal" | timechart count span=1s</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.data.count">0</option>
      </chart>
    </panel>
  </row>
</dashboard>

mporath_splunk
Splunk Employee
Splunk Employee

This bug has been fixed in the recent 6.3.1 maintenance release (released on 11/4/15).
Find more information and all bugfixes in the 6.3.1. Release Notes

mporath_splunk
Splunk Employee
Splunk Employee

Hi gschr, it looks like the setting works correctly but the warning message you get is not accurate. On dashboards, you should actually be able to see all results, even though the warning message shows the 1000 data point limit.

Out of curiosity: Is there a particular reason to show this many data points? The reason I'm asking is that at some point you run into a limit in terms of how many data points you can physically display on a screen. There might be better options to visualize this much data.

dmr195
Communicator

The setting works correctly in Splunk 6.2 but not in Splunk 6.3.0. It seems that any attempt to increase the limit above 1000 fails. For example, this also doesn't work in Splunk 6.3.0:

<option name="charting.data.count">50000</option>

You still get the message and the chart is truncated.

Also, whilst I agree that you cannot fit more than about 1000 points on a screen (or maybe 1700 on a standard 1920x1080 monitor taking into account borders), if a limit of 1000 is going to be enforced it should be done by skipping points evenly through the range rather than truncating.

And if this change was a deliberate design for Splunk 6.3 rather than a mistake then the documentation should have been updated.

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

Thanks for the feedback, dmr195.
Indeed, the truncation message you see in 6.3. is a bug. We already have an open ticket for this.
In our tests the charting.data.count setting works correctly in 6.3.0 both with 0 and 50000 as values. To reiterate, you'll still see the truncation message until we've fixed this. Could you double check that your data is truncated when raising the limit?
Long term, I agree, truncation is not optimal, and an even sampling would be more helpful.

0 Karma

cstarling
Explorer

By any chance is there an update on the ticket? I am having the same issue with a very similar graph to dmr195.

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

Unfortunately I can't give you an exact date. But we've looked into the bug and this should be addressed in one of the upcoming maintenance releases.

0 Karma

gschr
Path Finder

Hi mporath, thank you for your answer.
Yes, there is a reason for raising limit. The time series I want to plot has some small peaks and sharp edges, that you only see when you have timechart with a span of 1s while most of the time it is quite constant. To get a better overview you want to show periods of about an hour (3600 data points). It seems like there is still much space between the data points when you set the time period in a way only 1000 data points are displayed.

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

<option name="charting.data.count">0</option> should not raise any warning

0 Karma

dmr195
Communicator

This is a regression between Splunk 6.2 and Splunk 6.3. Is there already a bug raised for it in Splunk's bug tracking system? Or is it worth reporting to get it fixed?

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...