I'm using Splunk enterprise 5.0.5
I have a dashboard to chart the response time of a specific transaction.
Even though I have an inline search string in a panel and have set the time range to 24 hours, the panel only charts around last 2 hours.
Is this a product limitation or does it depend on number of results?
I now have to manually run the search, export, and chart in Excel rather than exposing the dashboard to intended audience.
Could be hitting some truncation limits as outlined here:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Viz/ChartDisplayissues
I assume you are being limited to 10 so Edit source
and change this:
<option name="count">10</option>
To this (or similar):
<option name="count">10000</option>
Could be hitting some truncation limits as outlined here:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Viz/ChartDisplayissues
It's formatting the xml. I basically used:
charting.chart.resultTruncationLimit = 10000
Since my 24 hour data had around 5000 results
charting.data.count = 0
Thanks,
Adding below line fixed it for me.
0
It looks like your paste failed ...?
You are doing something wrong but you have not given us any detail so nobody can help.
What do you want woodcock?
The XML for the non-working panel and the token values (usually timepicker
) that cause it not to run correctly.
Here's my xml:
Blockquote
Testing AB
<chart>
<searchString>sourcetype="Apache2" AND "method=PUT" AND "my confidential data" | rex field=Respond "^(?<Response_Time>\w+) " | table timestamp, Response_Time</searchString>
<title>Testing panel</title>
<earliestTime>-24h@h</earliestTime>
<latestTime>-1m@m</latestTime>
<option name="charting.axisTitleX.text">Seconds</option>
<option name="charting.axisTitleY.text">Timestamp</option>
<option name="charting.chart">line</option>
<option name="charting.primaryAxisTitle.text"></option>
<option name="charting.secondaryAxisTitle.text"></option>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
</chart>
Blockquote