charting.data.count worked in Splunk 6.2.x, but why not in Splunk 6.3.0? Is this a known issue?

[glentes]

Dear community,

We have several dashboards where we need to display more than the default 100 results in a visualization. In 6.2.x we where able to use :

<option name="charting.data.count">9999</option>

but in 6.3.0, using this option leads to the following output:

"These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. "

Even trying to set

<option name="charting.data.count">0</option>

to deactivate the limit completely is not working anymore.

Is this problem already known?

Thank you and regards

[mporath_splunk · Accepted solution]

This is a bug in 6.3. and has been fixed in the recent 6.3.1 maintenance release (released on 11/4/15).
Find more information and all bugfixes in the 6.3.1. Release Notes

[glentes]

Thank you for the answer.
We will update our test infrastructure and have see if the fix works before going to the productive one.

[kbecker]

We are using 6.3.1 and I still see the " These results may be truncated. Your search generated too much data for the current visualization configuration." message even with the following two options set. Is there still an bug associated with this?

10000000
10000000

This is the search

earliest=-60m index=_introspection host=carf-splunkil* component=Hostwide | timechart useother=f limit=80 span=10s values(data.normalized_load_avg_1min) by host