All Apps and Add-ons

Alert Manager- Incident Posture dashboard is super slow

agentsofshield
Path Finder

Hey, I've been using the Incident Posture dashboard as the SOC monitoring platform for about 6 months now and it worked great, now suddenly the dashboard is super slow, it takes about 3 minutes to load the incidents, which is a lot. Normal searches work fine.
Any idea why? The search heads are virtual and have 32GB RAM and 8 CPUs each.

Thanks in advance.

0 Karma
1 Solution

agentsofshield
Path Finder

The problem was with some debug incidents that made thousands of alerts per day, which made searching the alerts index very slow. I ended up disabling those alerts and deleting them from the alerts index.

View solution in original post

0 Karma

agentsofshield
Path Finder

The problem was with some debug incidents that made thousands of alerts per day, which made searching the alerts index very slow. I ended up disabling those alerts and deleting them from the alerts index.

0 Karma

my2ndhead
SplunkTrust
SplunkTrust

Can you check if you find any technical issues by looking at the job inspector?

If the number of incidents is high, enabling data model acceleration for the alerts data model might help.

In the upcoming version, the searches are rewritten to not use data models, this should speed up loading the dashboard.

0 Karma

agentsofshield
Path Finder

Apparently the problem was with some debug incidents that made thousands of alerts per day, which made searching the alerts index very slow.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...