Timechart is showing only first 50 results?

[toolsops]

I am using a timechart query to display data for each task(TASK_ID) and time taken for completing a task.
It is plotting a time chart with
x-axis = _time -> converting StarTime as _time
y-axis = duration (TimeDiffMins)
against TASK_ID.

My chart is showing only first 50 or less than 50 data. I want to display around 1000 - 2000 data at a time.

How to increase the limit of data to be displayed in chart? Do I need to modify any *.conf file?

Using following search:

index="xxxxx" sourcetype="zzzz" .......... eval TimeDiffMins = (END_TIME - START_TIME)/60| convert timeformat="%m/%d/%y %I:%M:%S %p" ctime(START_TIME) as StartTime | eval _time=strptime(StartTime, "%m/%d/%y %I:%M:%S %p")| timechart span=10m max(TimeDiffMins) by TASK_ID useother=f limit=0

When I select last 3 days, chart will shows data of first date only, and sametime it displays a message as given below

"Search generated too much data for the current display configuration, results have been truncated."
with link to url - http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/CustomChartingConfig-JSChart

I am struggling to get it resolved.

Anish

[MuS]

Hi toolsops and alexantao,

well the docs are pretty strait forward on this and tell you what can or should be done.

To remove the error message you can:

• Switch to a chart type that involves drawing only one shape per series (in other words, move from a column chart to a line chart).
• Reduce the number of fields that are being plotted.
• For time charts, use a longer time-span between data points.

There are additional conditions that can cause truncation:

Searches that return too many results per series can cause JSChart to hang the browser. Splunk employs a throttling strategy that restricts the number of results returned per series to 500 by default. You can configure this value by going to JSChart.conf and changing the maxResultsCount parameter to something other than 500.

JSChart can only plot the first 50 series that are returned. Additional series will not be plotted.

Object rendering limits by charting library. Both charting libraries have rendering limits if the total number of objects plotted in the chart exceeds a certain number. If you run into this limit you'll want to change either the search string or search time range so that the results returned fall under the limit.

For the FlashChart library, the rendering limit in all cases is 2000 objects. If you hit this limit, the chart stops rendering.

The JSChart library has a 2000 object limit for line and area charts, a 1200 object limit for bar, column, and scatter charts, and a 1000 object limit for charts displayed with Internet Explorer 8 or an earlier release of IE. If you hit the limit with a chart that uses JSChart, Splunk provides an error message.

Note: You can override the truncation limit for charts rendered with JSChart by changing the value of the charting.chart.resultTruncationLimit property on a per-chart basis. Note that this property is only available for panels rendered with JSChart. Also, be aware that increasing this truncation limit can have a negative effect on dashboard performance.



You can't change the FlashChart truncation limit of 2000 objects.

hope this helps ...

cheers, MuS

[alexantao]

Hi MuS,
In my case, something does not match.
I post the question here, for my specific case:
http://answers.splunk.com/answers/110500/dashboard-saved-search-results-is-being-truncated-to-1000

I am trying to plot an area chart representing the use of internet each day during 1 month.
The data of this chart, in teory,should have only 30 item, one per day, and only 2 columns (day/quantity).

Executing the search on the search app I can get the reults and the chart, but when I open the dashboard (which I put this chart based on a saved search with the same string), the error message is shown.
I made something similar with the stats command, but it is very dificult to sort the results properly.

thanks for the help.

[alexantao]

Hi, have you solved this problem ? I have a similar error, but my chart (in dashboard) displays nothing. It show that error message. I have milions of events, but the data to show in the chart is very small.
thanks...