Splunk Search
Highlighted

charting.data.count worked in Splunk 6.2.x, but why not in Splunk 6.3.0? Is this a known issue?

Path Finder

Dear community,

We have several dashboards where we need to display more than the default 100 results in a visualization. In 6.2.x we where able to use :

<option name="charting.data.count">9999</option>

but in 6.3.0, using this option leads to the following output:

"These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. "

Even trying to set

<option name="charting.data.count">0</option>

to deactivate the limit completely is not working anymore.

Is this problem already known?

Thank you and regards

0 Karma
Highlighted

Re: charting.data.count worked in Splunk 6.2.x, but why not in Splunk 6.3.0? Is this a known issue?

Splunk Employee
Splunk Employee

This is a bug in 6.3. and has been fixed in the recent 6.3.1 maintenance release (released on 11/4/15).
Find more information and all bugfixes in the 6.3.1. Release Notes

View solution in original post

Highlighted

Re: charting.data.count worked in Splunk 6.2.x, but why not in Splunk 6.3.0? Is this a known issue?

Path Finder

Thank you for the answer.
We will update our test infrastructure and have see if the fix works before going to the productive one.

0 Karma
Highlighted

Re: charting.data.count worked in Splunk 6.2.x, but why not in Splunk 6.3.0? Is this a known issue?

Communicator

We are using 6.3.1 and I still see the " These results may be truncated. Your search generated too much data for the current visualization configuration." message even with the following two options set. Is there still an bug associated with this?

10000000
10000000

This is the search

earliest=-60m index=_introspection host=carf-splunkil* component=Hostwide | timechart useother=f limit=80 span=10s values(data.normalized_load_avg_1min) by host
0 Karma