Dashboards & Visualizations

all my charts limited to 100 events (Dashboard & Search)

vgtk4431
Path Finder

When plotting a timechart on my SHCluster (just migrated to 8.0.6) it stopped rendering the data after 100 points.

Easy to be seen with a sample request:

 

 

|gentimes start=10/02/2020 increment=1h |eval _time=starttime|timechart count span=1h |streamstats count

 

 

At first I thought it was a new limit included in 8.0.6, but my configuration seems fine :

 

 

## Web.conf jschart parameter :
jschart_results_limit = 10000
jschart_series_limit = 100
jschart_test_mode = False
jschart_truncation_limit.chrome = 50000
jschart_truncation_limit.firefox = 50000
jschart_truncation_limit.ie11 = 50000
jschart_truncation_limit.safari = 50000

 

 

 

 

 

## Vizualisations line parameter :
[line]
allow_user_selection = True
core.charting_type = line
core.height_attribute = display.visualizations.chartHeight
core.icon = chart-line
core.order = 1
core.preview_image = line.png
core.recommend_for = timechart, predict
core.type = visualizations
core.viz_type = charting
data_sources = primary,annotation
data_sources.annotation.params.count = 1000
data_sources.annotation.params.output_mode = json_cols
data_sources.primary.params.count = $display.visualizations.charting.data.count:JSCHART_RESULTS_LIMIT:10000$
data_sources.primary.params.offset = 0
data_sources.primary.params.output_mode = json_cols
data_sources.primary.params.show_metadata = true
default_height = 300
default_width = 300
description = Track values and trends over time.
label = Line Chart
max_height = 10000
min_height = 100
min_width = 100
search_fragment = | timechart count [by comparison_category]
supports_drilldown = True
supports_export = True
supports_trellis = True
trellis_default_height = 400

 

 

 

I understand the precedence order linked to data_sources.primary.params.count

it's taking the charting.data.count value first (from the dashboards) , then the jschart_results_limit then fallback to 10000...

 

image.png

but i'm only in the search app, not in a dashboard, i've no option charting.data.count value so it should be using the jschart_results_limits which is 10000 based on my web.conf

Any ideads on what is happening ? The VERY strange thing is that it's only happening on my shcluster, my utility server is fine...

 

I've the same behavior on all the charting ...

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...