topic Re: How to accelerate the loading time of multiple dashboards? in Dashboards & Visualizations

How to accelerate the loading time of multiple dashboards?

taha13 — Thu, 22 Mar 2018 13:56:20 GMT

Hello everyone, so this time I don't have a problem with my code or dashboard, but my question is about the performance of my dashboard.

I have a dashboard with 15 panels and I want to know if there are tricks to optimize or accelerate the loading of the dashboard?

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Thu, 22 Mar 2018 14:16:26 GMT

I'm assuming you have 15 independent panels? If so then this is tieing up 15 CPU cores on your SH and possibly limiting the speed it returns values. You should look into using post processing so you can use 1-2 searches to drive those 15 panels. Once you have that, you can then explore other optimization techniques like tstats, metasearch or refactoring your search to make the panels load faster.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/Savedsearches#Post-process_searches_2

Feel free to share your search and I can help optimize it

Re: How to accelerate the loading time of multiple dashboards?

taha13 — Thu, 22 Mar 2018 14:21:47 GMT

i already used the base search,and i have one job for all the panels,the problem is that i have a lot of data.So to load my dashboard it take 5 to 7 minutes

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Thu, 22 Mar 2018 14:28:54 GMT

Ok, so your issue is with search speed.. Coming back to the later part of my comment, post your search so we can help optimize it

The answer will be one of the following
1) Refactor the search
2) Use tstats or metasearch if possible
3) Get more indexers
4) Decrease your sample size
5) Use a summary index or accelerated data model
6) Use event sampling

Re: How to accelerate the loading time of multiple dashboards?

taha13 — Thu, 22 Mar 2018 14:56:21 GMT

how can i accelerate the data model?

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Thu, 22 Mar 2018 15:02:36 GMT

You need a transformational command..

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Acceleratedatamodels

Share your search for more help or accept the answer. Not much more I can do without seeing your search

Re: How to accelerate the loading time of multiple dashboards?

taha13 — Tue, 29 Sep 2020 18:39:10 GMT

index="***"
| where feature="chat"
| table _time, MESSAGE, chatId, chatOrigin, media, chatNbreRepliqueAgent_lo, chatNbreRepliqueClient_lo,location,client,session,chatAvailability_lo,step,stepResult,isEligible_lo,context

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Thu, 22 Mar 2018 15:09:41 GMT

Lots of problems here.. How many indexes are you searching over? Is it possible to to explicitly call only the indexes needed? How large is your time frame? How many events are you searching over? How many indexers do you have? What storage are you using? You should replace where with search. I think it would be faster with a stats then it would be with a table command too.

Once you replace that table with a transformational command, you can accelerate it as a data model or a report and get exponentially faster speeds.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Report/Acceleratereports

Re: How to accelerate the loading time of multiple dashboards?

taha13 — Fri, 23 Mar 2018 08:39:49 GMT

1-I use just one index
2-I search event of the 4 last month
3-i have a lot of eent,300 MB of data

Re: How to accelerate the loading time of multiple dashboards?

niketn — Tue, 29 Sep 2020 18:39:33 GMT

@taha13, if you have created base search as Table command for pulling _raw events for Post Processing even that is not a best practice, you should have transforming command instead. Refer to documentation for Post Processing Best Practices: http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

To add on to @skoelpin 's comment where feature="chat" should actually be a part of your main search i.e.

     index="abc" festure="chat"

You should also understand that there is difference between table and fields command so use table only as your final command in case you need to arrange the fields in specific order as per your need.

Refer to the documentation for search query optimization

Also if you have 15 panels in a dashboard, do you need to view all of them at the same time? (usually it is 4, 6 or 8 panels at a time). If so you should enable Check Boxes/Links or Tabs to switch from One Panel to other or may be show details only when required. This way you restrict running only the searches which are required by default/or the users see first when the dashboard loads. Refer to Blog: https://www.splunk.com/blog/2015/03/30/making-a-dashboard-with-tabs-and-searches-that-run-when-clicked.html

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Fri, 23 Mar 2018 14:23:17 GMT

This would perform faster

index="YOUR_INDEX_NAME" feature="chat"
| stats values(MESSAGE) AS MESSAGE by _time

Do this for your other fields too. Look at the job inspector after running these searches to see speed

Re: How to accelerate the loading time of multiple dashboards?

taha13 — Tue, 27 Mar 2018 08:59:01 GMT

i changed table b fields to accelerate the research,the probem is ,when i use table it's return all the data of the month,but when i use field it's return just the last 15 days

Re: How to accelerate the loading time of multiple dashboards?

Moreilly97 — Tue, 27 Mar 2018 10:36:00 GMT

Reiterating what was said in previous posts try

 index="YOUR_INDEX_NAME" feature="chat"
 | stats values(MESSAGE) AS MESSAGE , values(chatId) AS chatId , values(chatOrigin) AS chatOrigin , values(media) AS media , values(chatNbreRepliqueAgent_lo) AS chatNbreRepliqueAgent_lo , values(chatNbreRepliqueClient_lo) AS chatNbreRepliqueClient_lo , values(location) AS location , values(client) AS client , values(session) AS session , values(chatAvailability_lo) AS chatAvailability_lo , values(step) AS step , values(stepResult) AS stepResult , values(isEligible_lo) AS isEligible_lo , values(context) AS context by _time

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Wed, 28 Mar 2018 13:46:58 GMT

Have you found a solution to the problem? If so, can you upvote/accept?

Re: How to accelerate the loading time of multiple dashboards?

taha13 — Tue, 29 Sep 2020 18:49:11 GMT

i changed my request ,now i use :
index="YOUR_INDEX_NAME" feature="chat"
| stats values(MESSAGE) AS MESSAGE by _time
It's accelerat my dashboard by 30sec

Re: How to accelerate the loading time of multiple dashboards?

taha13 — Thu, 29 Mar 2018 08:32:30 GMT

when i used "field" ,my dashboard is faster but i have the results of the 15 last days ,and not of all the week

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Thu, 29 Mar 2018 12:34:27 GMT

Please upvote/accept if this answered your question..

Re: How to accelerate the loading time of multiple dashboards?

taha13 — Thu, 29 Mar 2018 13:00:45 GMT

I already upvote the answer 😉

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Thu, 29 Mar 2018 13:34:13 GMT

Why not accept the answer? This answered your question and accelerated your search time..

Re: How to accelerate the loading time of multiple dashboards?

skoelpin — Mon, 02 Apr 2018 13:53:22 GMT

I downvoted this post because im downvoting this post because i gave you multiple approaches at solving your issue and you confirmed my solution works but refuse to accept the answer