All Apps and Add-ons

Timeline graph slow in rendering for large data

AKG1_old1
Builder

Hello,

I am using Time line in my dashboard. In case of large data say 10k, it takes 2-3 minutes to render on screen. Eventhough my query finished in only 1 sec. Even my whole dashboard freeze during rendering.

Is there any workaround for this issue ?

Timeline App Version = 1.1.0

Search Query:

| tstats summariesonly=true max(All_TPS_Logs.duration) AS duration max(All_TPS_Logs.context.id) AS ID values(All_TPS_Logs.Engine_ID) AS Engine_ID values(All_TPS_Logs.no_of_threads) AS No_of_Threads values(All_TPS_Logs.operationIdentity) AS operationIdentity FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=Luas_TestCampaign_PI9 All_TPS_Logs.operationIdentity="*processBatch*" All_TPS_Logs.Engine_ID = "196") GROUPBY All_TPS_Logs.riskGroup, _time span=1s
| rename All_TPS_Logs.riskGroup as riskGroup
| makemv riskGroup delim="\s" 
| eval RiskGroup_ID=riskGroup."_".ID
| sort 0 _time
| table _time RiskGroup_ID No_of_Threads duration

alt text

0 Karma

bandit
Motivator

Try moving your where clause before the first pipe, right before the FROM datamodel syntax. This should cause fewer records to be returned from the first part of the query. If that doesn't work, try pasting your full query as it's hard to see from just the screenshot.

AKG1_old1
Builder

@rob_jordan : thanks for reply. I have added search query in question. I have changed where clasue as you suggested but it doen't make much difference. If I convert results in table then its really quick. I think issue is with Timeline chart. we are using Timeline is few other dashboards and all of them are slow for large data.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...

Index This | What has many keys but can’t unlock a door?

July 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...