Splunk Search

How do I prevent my chart results from being truncated?

akazarov
Path Finder

Hello all,

I've seen a few similar discussions, but neither solution works for me - sorry for raising this again.

I have a search and a chart which produces big amount of results, and to plot it I use limiter
bins=2000 in my chart command. Yes, I want to display more then 1000 points on my UHD screen. But whatever chart options I use, it still complains with famous:

These results may be truncated. Your search generated too much data for the current visualization configuration.

and indeed the results are not complete. What I have in my chart XML code:

<option name="charting.data.count">3000</option>
<option name="charting.chart.resultTruncationLimit">3000</option>

Is there a working option? I could not find anything relevant in limits.conf. My splunk version is 6.3.0.

Thanks!

1 Solution

akazarov
Path Finder

I think this was resolved in the newer releases following 6.3.0.

View solution in original post

0 Karma

akazarov
Path Finder

I think this was resolved in the newer releases following 6.3.0.

0 Karma

kbecker
Communicator

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this.

Thanks,
Ken

0 Karma

jplumsdaine22
Influencer

Have you seen: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/ChartDisplayissues

Your code looks right, can you post the full XML? it may be that your tag is in the wrong spot. Also put your search string if possible

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...