Chart only plots 500 results

[philallen1]

Hi

This seems like such a simple thing, yet I can't get it working in Splunk.

This is my search:

sourcetype="PADBService" Every5MinutesDuration=* | chart values(Every5MinutesDuration) over _time

This brings back approximately 1600 results for the last 7 days. However, when I look at the graph view, the graph only plots 500 results (effectively missing out on over 4 day's data)

This is so frustrating as I just want it to plot the 1600 results. Does anyone out there have any suggestions? I don't want to average the results, I simply want each result plotted on the graph.

Thanks in advance.

[nekb1958 · Accepted solution]

Oh yes, this is frustrating!
for me the point "Search result truncation" at

http://docs.splunk.com/Documentation/Splunk/5.0.3/Viz/CustomChartingConfig-JSChart

helped to understand the source of this behavior. maybe it helps you too.
bye norbert

[philallen1]

That's fixed it - thanks a lot to both of you.

[lguinn2]

To expand, here is the text that Norbert references:

Searches that return too many results per series can cause JSChart to hang the browser. Splunk employs a throttling strategy that restricts the number of results returned per series to 500 by default. You can configure this value by going to JSChart.conf and changing the maxResultsCount parameter to something other than 500.

Thanks! I didn't realize that JSChart had that limitation.

[lguinn2]

Try this

sourcetype="PADBService" Every5MinutesDuration=* 
| timechart span=5m avg(Every5MinutesDuration)

The Y value for timechart or chart must be one of the functions. That seems like a problem - you want the values not the average! But I don't want to use the values function - what if there is more that one value for the 5 minute period? If there is only one value (as there should be) then the average = the single value. But if there is more than one value in a time period (which there shouldn't be), at least you get an average rather than ignoring the extra values.

One problem you may be having is that there are only so many possible points on a chart. I am not sure.

[philallen1]

Hi, thanks for your answer.

Unfortunately I'm still getting the same issue in that the graph only plots 500 points on it. I've replicated the graph in Excel to see what it would look like (i.e. would it look too cramped with 1600 points?) but it actually plots fine. I'm not sure why Splunk is restricting me to only 500 points. If you, or anyone else, has any advice please let me know.

Thanks