Reporting

Forcing report to chart last month of data?

cpmesh
Engager

I'm trying to create a report that will show a month worth of data in 20 minute spans. I have the spans set at 20 minutes and the time range set to last 30 days but the report only shows the first 8 days of that 30 day period. (the data covers the full 30 day period)

Any suggestions?

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Splunk's chart rendering subsystem is configured to only show 500 data rows by default, as each point takes a couple of pixels and it's unlikely that your display device has more than a few thousand pixels. I'm assuming that your table below the chart shows all 2160 rows of data.

Are you just interested in a chart here? If so, why do you need span=20m? If not, is the table correct?

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

Splunk's chart rendering subsystem is configured to only show 500 data rows by default, as each point takes a couple of pixels and it's unlikely that your display device has more than a few thousand pixels. I'm assuming that your table below the chart shows all 2160 rows of data.

Are you just interested in a chart here? If so, why do you need span=20m? If not, is the table correct?

Stephen_Sorkin
Splunk Employee
Splunk Employee

Assuming you have a custom dashboard, you can tweak the maxResultCount property for FlashChart as in http://www.splunk.com/base/Documentation/4.1.4/Developer/ModuleReference#FlashChart. There's no way to change this setting for the charting sections in the UI.

0 Karma

cpmesh
Engager

The table below is correct, I'm just trying to get the chart to display the full month if possible. I have span set to 20m because the data set that I need to average updates every 20 minutes and I need the table to be accurate. The chart displays the full month on the dashboard, I'm hoping to duplicate that chart on the report

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...