Splunk O11y Dashboard panel shows no data or 0 due to MTS limit

Available Languages

Updated:October 1, 2026
Document ID:SPLK055056

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Application Performance Monitoring Splunk Infrastructure Monitoring

Description

A dashboard panel fails to display data or shows 0 despite other views showing active traffic. The issue is triggered when high cardinality dimensions (such as operation, host, or custom tags) multiply into tens of thousands of time series, exceeding the hard cap of 50,000 Metric Time Series (MTS) in the analytics engine. Once the limit is reached, the engine cannot compute accurately, and the plot collapses to 0.

Although there is sufficient data/MTS available, the above dashboard has been showing 0 for the past few days, which may be misleading since data is still flowing in.

When the same SignalFlow used in this dashboard is applied to a Classic Chart, the following warning message appears, which helps explain this behavior:

“A maximum of 50,000 time series can be analysed in a single plot. The number of time series in line 1 exceeds the maximum.”


Investigation

  1. Navigate to the affected Dashboard.
  2. Identify the panel showing 0 or no data.
  3. Open the panel in Classic Chart to check for engine warnings.
  4. Verify if the following warning is present: "A maximum of 50,000 time series can be analysed in a single plot."
  5. Reduce the time range to a very small window (e.g., 15 minutes). If data appears, the issue is confirmed as a cardinality limit hit.

In the dashboard above, when the time range is reduced to one day, the chart displays data because the number of MTS falls within the 50,000 limit.


Resolution

  1. Open the affected panel in the Dashboard editor.
  2. Modify the SignalFlow query to apply more granular filters, such as sf_operation or specific tags, to reduce the number of scanned MTS.
  3. Use a smaller time range for the dashboard view to stay under the 50,000 MTS limit.
  4. If the issue persists due to short-lived MTS, reduce the MTS inactivity window to deactivate inactive series more quickly.

Max_Number_Of_MetricTimeSeries_Processed_In_A_Signal

System_limits_details_for_Splunk_Infrastructure

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Articles