Max data points that charts can handle?

[melonman]

Hi,

I am looking for the chart property to control the max number of data points that a chart can handle.
There are some posts in Answers related to this topic but I still can not find the configuration parameter for this.

I would appreciate if anyone could point me to the information about this.

Thank you all in advance.

[akazarov]

For me, charting.chart.resultTruncationLimit works with splunk 6.3.3 and does NOT work with 6.3.0.

[melonman]

Now I am using this to plot timechart count span=1s for 1hour data.
This is for per-chart config in simple XML.

<option name="charting.data.count">4000</option>
<option name="charting.chart.resultTruncationLimit">3000</option>

[melonman]

http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/ChartConfigurationReference

charting.data.count

The number of results to retrieve. Set to 0 to get all results.

charting.chart.resultTruncationLimit

Override default rendering limits for the total number of objects plotted in a chart. These apply to cartesian (dual axis) charts.

column: 1200
bar: 1200
line: 2000
area: 2000

[davidpaper]

Hi,

To expand on yannK's answer excellent, there appears to be 2 config items in JSChart that would affect this, and they both live in $SPLUNK/share/splunk/search_mrsparkle/modules/results/flash/JSChart.conf.

1) [param:maxResultCount]
required = False
default = 500

I changed this to:

default = 5000

to allow jschart to pull in more data points per series.

2) [param:resultTruncationLimit]
required = False
default = 0

change this to something other than 0, so that for EVERY JSChart that gets rendered, it gets the benefit of the higher limit, instead of having to put that xml setting change in for every panel.

I set default = 20000 and at least with Google Chrome as the browser, it has no problems.

Hope this helps.

[davidpaper]

No. This is a server-wide config, and can't be set per app.

[akazarov]

For me these 2 settings has no effect. What is important is to have NofBins * NofSeries < charting.chart.resultTruncationLimit in the chart.

[linu1988]

Can i change this config specific to one app?

[hexx]

Nice one. Do note, however, that this customization is not upgrade-resilient and will need to be re-applied every time Splunk is upgraded.

[yannK · Accepted solution]

see http://docs.splunk.com/Documentation/Splunk/5.0.1/Viz/CustomChartingConfig-JSChart#Search_result_tru...

Object rendering limits by charting library. Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit you'll want to change either the search string or search time range so that the results returned fall under the limit.

• For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.
• The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. If you hit the limit with a chart that uses JSChart, Splunk provides an error message

Note: You can override the truncation limit for charts rendered with JSChart by changing the value of the charting.chart.resultTruncationLimit property on a per-chart basis. Note that this property is only available for panels rendered with JSChart. Also, be aware that increasing this truncation limit can have a negative effect on dashboard performance.

You can't change the FlashChart truncation limit of 2000 objects

[melonman]

Thank you!