Splunk Search

Timechart graph cuts off data

Path Finder

I'm running a search like this:

index=summary splunk_server=local search_name=SOMESEARCH earliest=-1mon@mon latest=@mon | timechart span=1h sum(count) as Total

and plotting it on a graph. The search works fine and all the data is there but when I create a graph or put this in a dashboard the graph only show data up until the 21st of the month??

This worked perfectly fine on 4.2.3 but not working now on 4.3?

Anybody come across this?

0 Karma
1 Solution

Path Finder

http://docs.splunk.com/Documentation/Splunk/latest/Developer/AdvancedCharting

From the docs:

For performance reasons, the JSChart module truncates search result data sets that are too large. The exact limits that trigger this truncation depend on the browser being used as well as the charting configuration.

I switch to using the FlashChart module instead and now everything works 100%...

View solution in original post

0 Karma

Path Finder

http://docs.splunk.com/Documentation/Splunk/latest/Developer/AdvancedCharting

From the docs:

For performance reasons, the JSChart module truncates search result data sets that are too large. The exact limits that trigger this truncation depend on the browser being used as well as the charting configuration.

I switch to using the FlashChart module instead and now everything works 100%...

View solution in original post

0 Karma

Path Finder

I've investigated further and realized that if I set the span on the timechart to 2h instead of 1h it works!

This must be some sort of Splunk bug?

0 Karma

Builder

I just encountered this myself. I think you're hitting the "reasonable resolution" limit discussed here: http://splunk-base.splunk.com/answers/33050/a-month-time-of-x-axis-with-span-of-5-min-window If no timespan is specified, Splunk picks a reasonable default based on the time range and returns data over the entire range, but if you bother to explicitly specify a timespan, it figures you must really care about the detail, so it sacrifices some of the range in order to display what you asked for.

0 Karma