Splunk Search

charting.data.count worked in Splunk 6.2.x, but why not in Splunk 6.3.0? Is this a known issue?

glentes
Path Finder

Dear community,

We have several dashboards where we need to display more than the default 100 results in a visualization. In 6.2.x we where able to use :

<option name="charting.data.count">9999</option>

but in 6.3.0, using this option leads to the following output:

"These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. "

Even trying to set

<option name="charting.data.count">0</option>

to deactivate the limit completely is not working anymore.

Is this problem already known?

Thank you and regards

0 Karma
1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

This is a bug in 6.3. and has been fixed in the recent 6.3.1 maintenance release (released on 11/4/15).
Find more information and all bugfixes in the 6.3.1. Release Notes

View solution in original post

mporath_splunk
Splunk Employee
Splunk Employee

This is a bug in 6.3. and has been fixed in the recent 6.3.1 maintenance release (released on 11/4/15).
Find more information and all bugfixes in the 6.3.1. Release Notes

glentes
Path Finder

Thank you for the answer.
We will update our test infrastructure and have see if the fix works before going to the productive one.

0 Karma

kbecker
Communicator

We are using 6.3.1 and I still see the " These results may be truncated. Your search generated too much data for the current visualization configuration." message even with the following two options set. Is there still an bug associated with this?

10000000
10000000

This is the search

earliest=-60m index=_introspection host=carf-splunkil* component=Hostwide | timechart useother=f limit=80 span=10s values(data.normalized_load_avg_1min) by host
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...