topic Re: Splunk UI is very slow in Splunk Search

Splunk UI is very slow

rsruthi48 — Fri, 22 Aug 2025 04:52:25 GMT

I'm trying to learn Splunk and i installed the Splunk Free trial version 9.1.2

I've been using this free version for over a month now and 2weeks ago i ingested Botsv1 and Botsv2 datasets into Splunk along with the recommended add-ons. Up until yesterday I did not face any slowness and suddenly today Splunk is very unresponsive, every click takes almost 2mins to load.

I checked my resources and there is no issue there, my memory is at 50% usage since Day-1 I installed Splunk and there is also 100GB of free space available in my C:\. I'm only using Splunk as a Search-Head so I'm not performing any complex activities for it to get this slow.

Any suggestions to improve its speed?

Re: Splunk UI is very slow

livehybrid — Fri, 22 Aug 2025 05:22:09 GMT

Hi @rsruthi48

Generally speaking Splunk uses most of its resources when either indexing new data, or searching data. If you are just navigating around the UI it shouldnt use too much resource and definitely wouldn't expect it to degrade over time.

Please could you try accessing using Incognito mode to see if that makes a difference? Also its worth checking the logs in $SPLUNK_HOME/var/log/splunk/splunkd.log to see if there are any obvious errors relating to the pages being loaded.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk UI is very slow

rsruthi48 — Fri, 22 Aug 2025 05:33:09 GMT

Hi livehybrid

Restarting Splunk worked.

Re: Splunk UI is very slow

isoutamo — Fri, 22 Aug 2025 12:19:30 GMT

You should use some more recent version than 9.1. It's already out of support phase. See https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core

Please try e.g. 9.4.4 which should be quite ok for testing and production use.

Those bots version are also old and especially TA's etc. which it's used are also outdated and even archived.

There is also bots.splunk.com where you can training some use cases with guides.