timechart max points on x axis

[anuragkapur]

I have read in a few places that the max points that can be plot using a timechart is 1000. I have the following query which returns 960 data points.

host="myhost" source="/mylogs/a.log" resptime="*" | timechart span=90s avg(resptime) as avg_response_time

I run this query over 24 hour periods and the timespan is set to 90s. => 960 datapoints. However, these do not fit in a single view. i.e. I dont see all points on the x axis. I think roughly about 480 fit in a single view.

Any idea what I am doing wrong?

[martin_mueller · Accepted solution]

There are two different limits to consider. One is the number of objects a JSChart likes to display, that's 1200 and may be what you have read - if you have a bar chart with four serieses you can display up to 300 rows, giving you 1200 objects to display. Area and line charts don't create that many objects. The other is the number of data points on the x-axis, that appears to be 500 for either one.

Personally I'm doubtful that you need more. If you want to visualize single peaks you can consider plotting both averages and maximums/minimums, or maybe an Xth percentile.

[anuragkapur]

Used the following query (as suggested) and got what I wanted: host="myhost" source="/mylogs/a.log" resptime="*" | timechart span=3m perc95(resptime)

[anuragkapur]

I am using splunk v5.0.2