Splunk Search

Max data points that charts can handle?

melonman
Motivator

Hi,

I am looking for the chart property to control the max number of data points that a chart can handle.
There are some posts in Answers related to this topic but I still can not find the configuration parameter for this.

I would appreciate if anyone could point me to the information about this.

Thank you all in advance.

Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

see http://docs.splunk.com/Documentation/Splunk/5.0.1/Viz/CustomChartingConfig-JSChart#Search_result_tru...

Object rendering limits by charting library. Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit you'll want to change either the search string or search time range so that the results returned fall under the limit.

  • For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.
  • The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. If you hit the limit with a chart that uses JSChart, Splunk provides an error message

Note: You can override the truncation limit for charts rendered with JSChart by changing the value of the charting.chart.resultTruncationLimit property on a per-chart basis. Note that this property is only available for panels rendered with JSChart. Also, be aware that increasing this truncation limit can have a negative effect on dashboard performance.

You can't change the FlashChart truncation limit of 2000 objects

View solution in original post

akazarov
Path Finder

For me, charting.chart.resultTruncationLimit works with splunk 6.3.3 and does NOT work with 6.3.0.

0 Karma

melonman
Motivator

Now I am using this to plot timechart count span=1s for 1hour data.
This is for per-chart config in simple XML.

<option name="charting.data.count">4000</option>
<option name="charting.chart.resultTruncationLimit">3000</option>
0 Karma

melonman
Motivator

http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/ChartConfigurationReference

charting.data.count

The number of results to retrieve. Set to 0 to get all results.

charting.chart.resultTruncationLimit

Override default rendering limits for the total number of objects plotted in a chart. These apply to cartesian (dual axis) charts.

column: 1200
bar: 1200
line: 2000
area: 2000

0 Karma

davidpaper
Contributor

Hi,

To expand on yannK's answer excellent, there appears to be 2 config items in JSChart that would affect this, and they both live in $SPLUNK/share/splunk/search_mrsparkle/modules/results/flash/JSChart.conf.

1) [param:maxResultCount]
required = False
default = 500

I changed this to:

default = 5000

to allow jschart to pull in more data points per series.

2) [param:resultTruncationLimit]
required = False
default = 0

change this to something other than 0, so that for EVERY JSChart that gets rendered, it gets the benefit of the higher limit, instead of having to put that xml setting change in for every panel.

I set default = 20000 and at least with Google Chrome as the browser, it has no problems.

Hope this helps.

davidpaper
Contributor

No. This is a server-wide config, and can't be set per app.

0 Karma

akazarov
Path Finder

For me these 2 settings has no effect. What is important is to have NofBins * NofSeries < charting.chart.resultTruncationLimit in the chart.

0 Karma

linu1988
Champion

Can i change this config specific to one app?

0 Karma

hexx
Splunk Employee
Splunk Employee

Nice one. Do note, however, that this customization is not upgrade-resilient and will need to be re-applied every time Splunk is upgraded.

yannK
Splunk Employee
Splunk Employee

see http://docs.splunk.com/Documentation/Splunk/5.0.1/Viz/CustomChartingConfig-JSChart#Search_result_tru...

Object rendering limits by charting library. Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit you'll want to change either the search string or search time range so that the results returned fall under the limit.

  • For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.
  • The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. If you hit the limit with a chart that uses JSChart, Splunk provides an error message

Note: You can override the truncation limit for charts rendered with JSChart by changing the value of the charting.chart.resultTruncationLimit property on a per-chart basis. Note that this property is only available for panels rendered with JSChart. Also, be aware that increasing this truncation limit can have a negative effect on dashboard performance.

You can't change the FlashChart truncation limit of 2000 objects

melonman
Motivator

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...