I am attempting to generate an area chart for the past 15 days using the following search: index=test sourcetype=abcd source=1234 field1=* | timechart span=1h count by field1 useother=f limit=0 field1 has approximately 160 distinct values. Given this in conjunction with the time range and 1 hour span this results in almost 60,000 data points to be plotted. When attempting to chart this, I get the error These results may be truncated. Your search generated too much data for the current visualization configuration. I have done the following to attempt to resolve this issue: Edit the source XML for the chart/dashboard panel by adding charting.data.count=0 Edit the source XML for the chart/dashboard panel by adding charting.resultTruncationLimit=60000 Edit the local web.conf file by adding jschart_truncation_limit=0 None of the above fixes have resulted in the chart rendering with all the results. Are there any other potential solutions to this issue that I can try? Thanks for your assistance. ... View more

Hi there, I've been tasked with building a Splunk Enterprise 6.3 multisite virtual environment sandbox. The environment is to consist of the following Splunk instances: 5 search heads in a search head cluster 7 indexers (3 sites x 2 indexers + 1 cluster master) 1 combined deployment server, license master, deployer 2 forwarders installed on Linux images In addition to the above instances, the virtual host should also be able to accommodate a separate distributed search environment consisting of: 1 search head (also acting as deployment server and license master) 2 indexers 2 forwarders installed on Linux images So in all, a total of 20 virtual instances will be hosted. As this is a sandbox environment, the volume of data being forwarded/indexed will be minimal - definitely less than 10GB/day if that. We will be using VirtualBox for the images with CentOS 7 - minimal as the operating system on the images. Given the above criteria, I need to procure the machine that will host all of these images. Specifically I need to know: Recommended processor. Number of CPUs/cores required Minimum clock-speed RAM Number of hard drives required Individual hard drive capacity Individual hard drive specs Hard drive RAID configuration I would also need to know the specifications that the individual CentOS 7 virtual images (for the different types of instances) would require such as: Allocated RAM Allocated disk space Allocated CPU If I have missed any critical specification then please feel free to add/comment on that also. Thanks for your assistance. Amyn ... View more