Is it possible to have JSChart render its bars horizontally? I've looked over the properties here: http://docs.splunk.com/Documentation/Splunk/4.3/Developer/CustomChartingConfig-chartlegend and it looks like "bar" is what I want ("The bar chart is a cartesian chart that renders data as horizontal bars"). However, when I try to use the charting.chart properties I get an error: "Misconfigured view 'overview' - Unknown parameter 'charting.chart' is defined for module JSChart. Make sure the parameter is specified in JSChart.conf." Based on the example in the above document, I was using: <param name="charting.chart">bar</param> Is that indeed the correct parameter? ... View more

I am trying to use HiddenSearch and HiddenPostProcess in a few places to re-use the same result set, based on the documentation here: http://docs.splunk.com/Documentation/Splunk/latest/Developer/PostProcess I'm running in to a serious problem, however: the results appear to be truncated, and silently. I'm looking for 24 hours of results and I'm getting about 4.5 hours worth. Is there a way to a) determine if the HiddenPostProcess module really is discarding results and b) increase the limit, if so? Here's the source I am using: <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True"> <param name="search"><![CDATA[ index=foo sourcetype=foo_bar | rex field=_raw "host=\"(?<realhost>[^\"]+)\"" | fields _time, severity, program, message, realhost ]]></param> <param name="earliest">-24h</param> <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1"> <param name="search"><![CDATA[ search severity<4 | timechart span=5m count by severity ]]></param> <module name="HiddenChartFormatter"> <param name="chart">area</param> <param name="primaryAxisTitle.text">time</param> <param name="secondaryAxisTitle.text">error count</param> <param name="legend.placement">none</param> <module name="JSChart"> <param name="width">100%</param> <param name="height">300px</param> </module> </module> </module> </module> ... View more