All Apps and Add-ons

Timeline graph slow in rendering for large data

AKG1_old1
Builder

Hello,

I am using Time line in my dashboard. In case of large data say 10k, it takes 2-3 minutes to render on screen. Eventhough my query finished in only 1 sec. Even my whole dashboard freeze during rendering.

Is there any workaround for this issue ?

Timeline App Version = 1.1.0

Search Query:

| tstats summariesonly=true max(All_TPS_Logs.duration) AS duration max(All_TPS_Logs.context.id) AS ID values(All_TPS_Logs.Engine_ID) AS Engine_ID values(All_TPS_Logs.no_of_threads) AS No_of_Threads values(All_TPS_Logs.operationIdentity) AS operationIdentity FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=Luas_TestCampaign_PI9 All_TPS_Logs.operationIdentity="*processBatch*" All_TPS_Logs.Engine_ID = "196") GROUPBY All_TPS_Logs.riskGroup, _time span=1s
| rename All_TPS_Logs.riskGroup as riskGroup
| makemv riskGroup delim="\s" 
| eval RiskGroup_ID=riskGroup."_".ID
| sort 0 _time
| table _time RiskGroup_ID No_of_Threads duration

alt text

0 Karma

bandit
Motivator

Try moving your where clause before the first pipe, right before the FROM datamodel syntax. This should cause fewer records to be returned from the first part of the query. If that doesn't work, try pasting your full query as it's hard to see from just the screenshot.

AKG1_old1
Builder

@rob_jordan : thanks for reply. I have added search query in question. I have changed where clasue as you suggested but it doen't make much difference. If I convert results in table then its really quick. I think issue is with Timeline chart. we are using Timeline is few other dashboards and all of them are slow for large data.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...