I am using a timechart query to display data for each task(TASK_ID) and time taken for completing a task.
It is plotting a time chart with
x-axis = _time -> converting StarTime as _time
y-axis = duration (TimeDiffMins)
My chart is showing only first 50 or less than 50 data. I want to display around 1000 - 2000 data at a time.
How to increase the limit of data to be displayed in chart? Do I need to modify any *.conf file?
Using following search:
index="xxxxx" sourcetype="zzzz" .......... eval TimeDiffMins = (END_TIME - START_TIME)/60| convert timeformat="%m/%d/%y %I:%M:%S %p" ctime(START_TIME) as StartTime | eval _time=strptime(StartTime, "%m/%d/%y %I:%M:%S %p")| timechart span=10m max(TimeDiffMins) by TASK_ID useother=f limit=0
When I select last 3 days, chart will shows data of first date only, and sametime it displays a message as given below
"Search generated too much data for the current display configuration, results have been truncated."
with link to url - http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/CustomChartingConfig-JSChart
I am struggling to get it resolved.
... View more