Splunk JSChart truncation message not being displayed

[alanfinlay]

According to the documentation, an error message should be displayed when exceeding the 1000 or 2000 object limit for charts rendered by JSChart. I have not seen this error message using Firefox (23.0.1) or IE (9.0.8112.16421 64 bit). Is this a browser issue?

When I look at the source HTML I do see code for a message, but it is not displayed, and that code is present even when there is no truncation:

<div class="JSChartContainer" style="width:100%; height:333px;"></div> <div class="inlineMessageContainer" style="display: none;">
    <p class="resultStatusMessage">
        <span class="inlineMessage">
            Search generated too much data for the current display configuration, results have been truncated.
            <span class="resultStatusHelp">
                <a href="/en-US/help?location=learnmore.charting.datatruncation" target="_blank" title="Splunk help" class="spl-external-link spl-icon-external-link-xsm">Learn More</a> 
            </span>
        </span>
    </p> </div>
    </div>

[nmistry_splunk · Accepted solution]

Dont worry, you may have not hit the limit yet!

The notice is hidden by default, using style="display: none;" attribute, and when you will hit the limit, javascript will drop that attribute and make the block visible.

You could run the following search as a test: index=_internal | stats count(*) by _time

[Karunamon]

Are there any plans to raise the number of events that can be graphed?

[nmistry_splunk]

As a workaround -
1. Try to ensure such charts on dashboard have a row by themselves. This will allow the chart to cover as much width as it can. For ex. expand the 500px to 600px.
2. Reduce the number of points you are plotting by increasing the span from 15m to say 30m.

This is a bug, and we will work on improving the messaging.

[nmistry_splunk]

I see. The issue is overflow on the x-axis does not alert the user. The issue here is the size of the chart of smaller than the actual number of points it tries to plot on it. For example: you size of the chart is 500px, but the sum of all the points you are tying to plot is 800px. As a result, you can see the first 500px but the remaining 300px are hidden.

[alanfinlay]

Maybe I am confused about what triggers this message. I have a timeseries chart (line) for 7 days of results and I only see the first 5 days if I pick results per 15 mins = 672. So it seems there is a 500 time point limit somewhere.

sourcetype="Perfmon:CPU Load" counter="% Processor Time" | timechart span=15m avg(Value)