All Apps and Add-ons

Timeline graph slow in rendering for large data

AKG1_old1
Builder

Hello,

I am using Time line in my dashboard. In case of large data say 10k, it takes 2-3 minutes to render on screen. Eventhough my query finished in only 1 sec. Even my whole dashboard freeze during rendering.

Is there any workaround for this issue ?

Timeline App Version = 1.1.0

Search Query:

| tstats summariesonly=true max(All_TPS_Logs.duration) AS duration max(All_TPS_Logs.context.id) AS ID values(All_TPS_Logs.Engine_ID) AS Engine_ID values(All_TPS_Logs.no_of_threads) AS No_of_Threads values(All_TPS_Logs.operationIdentity) AS operationIdentity FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=Luas_TestCampaign_PI9 All_TPS_Logs.operationIdentity="*processBatch*" All_TPS_Logs.Engine_ID = "196") GROUPBY All_TPS_Logs.riskGroup, _time span=1s
| rename All_TPS_Logs.riskGroup as riskGroup
| makemv riskGroup delim="\s" 
| eval RiskGroup_ID=riskGroup."_".ID
| sort 0 _time
| table _time RiskGroup_ID No_of_Threads duration

alt text

0 Karma

bandit
Motivator

Try moving your where clause before the first pipe, right before the FROM datamodel syntax. This should cause fewer records to be returned from the first part of the query. If that doesn't work, try pasting your full query as it's hard to see from just the screenshot.

AKG1_old1
Builder

@rob_jordan : thanks for reply. I have added search query in question. I have changed where clasue as you suggested but it doen't make much difference. If I convert results in table then its really quick. I think issue is with Timeline chart. we are using Timeline is few other dashboards and all of them are slow for large data.

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...