Is it possible to have JSChart render its bars horizontally? I've looked over the properties here: http://docs.splunk.com/Documentation/Splunk/4.3/Developer/CustomChartingConfig-chartlegend and it looks like "bar" is what I want ("The bar chart is a cartesian chart that renders data as horizontal bars"). However, when I try to use the charting.chart properties I get an error: "Misconfigured view 'overview' - Unknown parameter 'charting.chart' is defined for module JSChart. Make sure the parameter is specified in JSChart.conf." Based on the example in the above document, I was using: <param name="charting.chart">bar</param> Is that indeed the correct parameter? ... View more

I am trying to use HiddenSearch and HiddenPostProcess in a few places to re-use the same result set, based on the documentation here: http://docs.splunk.com/Documentation/Splunk/latest/Developer/PostProcess I'm running in to a serious problem, however: the results appear to be truncated, and silently. I'm looking for 24 hours of results and I'm getting about 4.5 hours worth. Is there a way to a) determine if the HiddenPostProcess module really is discarding results and b) increase the limit, if so? Here's the source I am using: <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True"> <param name="search"><![CDATA[ index=foo sourcetype=foo_bar | rex field=_raw "host=\"(?<realhost>[^\"]+)\"" | fields _time, severity, program, message, realhost ]]></param> <param name="earliest">-24h</param> <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1"> <param name="search"><![CDATA[ search severity<4 | timechart span=5m count by severity ]]></param> <module name="HiddenChartFormatter"> <param name="chart">area</param> <param name="primaryAxisTitle.text">time</param> <param name="secondaryAxisTitle.text">error count</param> <param name="legend.placement">none</param> <module name="JSChart"> <param name="width">100%</param> <param name="height">300px</param> </module> </module> </module> </module> ... View more

I am trying to use append to combine the results of two searches, but when I use append the search time explodes. Individually, the two searches take a few seconds each. Together, the search takes over five minutes. The full search: index=foo sourcetype=foo_st | append [search index=bar sourcetype=bar_st] | timechart count by index over a 24 hour period. Individually, the searches find a small set of results (336k and 42k respectively). Together, with the above append command, the Search Job Inspector reports that the append component has an input count of 57,000,000,000 and an output count of 58,000,000, which seems completely insane and arbitrary. timechart ends up with an input count of 58,000,042,474. I suspect that append is somehow multiplying the result rows or something. FWIW, the "matching event" counter on the UI says 379,453 events. And this is with Splunk 4.3.2. Has anyone else seen this issue and, if so, what did you do to resolve it? What can I view using the Splunk UI to try to diagnose the problem? I've left this question open in case someone knows how to diagnose the 57-58 billion result problem, or how to use the UI to diagnose the problem. ... View more