The following dashboard contains a search that returns more than 1000 values (3600). I want to visualize all of them, but there is a maximum number of values a Splunk chart can display. The option <option name="charting.data.count">0</option> is supposed to raise this limit or deactivate it (http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/ChartConfigurationReference).
This option doesn't seem to have effect on the Dashboard in Splunk 6.3.
<dashboard> <label>Test charting.data.count</label> <row> <panel> <chart> <search> <query>index="_internal" | timechart count span=1s</query> <earliest>-60m@m</earliest> <latest>now</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">minimal</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="charting.data.count">0</option> </chart> </panel> </row> </dashboard>
Hi gschr, it looks like the setting works correctly but the warning message you get is not accurate. On dashboards, you should actually be able to see all results, even though the warning message shows the 1000 data point limit.
Out of curiosity: Is there a particular reason to show this many data points? The reason I'm asking is that at some point you run into a limit in terms of how many data points you can physically display on a screen. There might be better options to visualize this much data.
The setting works correctly in Splunk 6.2 but not in Splunk 6.3.0. It seems that any attempt to increase the limit above 1000 fails. For example, this also doesn't work in Splunk 6.3.0:
You still get the message and the chart is truncated.
Also, whilst I agree that you cannot fit more than about 1000 points on a screen (or maybe 1700 on a standard 1920x1080 monitor taking into account borders), if a limit of 1000 is going to be enforced it should be done by skipping points evenly through the range rather than truncating.
And if this change was a deliberate design for Splunk 6.3 rather than a mistake then the documentation should have been updated.
Thanks for the feedback, dmr195.
Indeed, the truncation message you see in 6.3. is a bug. We already have an open ticket for this.
In our tests the
charting.data.count setting works correctly in 6.3.0 both with
50000 as values. To reiterate, you'll still see the truncation message until we've fixed this. Could you double check that your data is truncated when raising the limit?
Long term, I agree, truncation is not optimal, and an even sampling would be more helpful.
Hi mporath, thank you for your answer.
Yes, there is a reason for raising limit. The time series I want to plot has some small peaks and sharp edges, that you only see when you have timechart with a span of 1s while most of the time it is quite constant. To get a better overview you want to show periods of about an hour (3600 data points). It seems like there is still much space between the data points when you set the time period in a way only 1000 data points are displayed.