All Apps and Add-ons

Timeline graphs causing slowness even when they are not been displayed

robertlynch2020
Influencer

Hi

The below panel is only used 1% of the time, however it is causing my dashboard to be very very slow even when it is not displaying.

The tstat is quick in a search, however $GANTT_CHART_ON$ is off most of the time, but the whole dashboard is slow, i don't mind it been slow when i want to see the "timeline" Graph, but it is like it is drawing it when i don't want to see it. As a result i am getting 10 seconds hangs.

<panel depends="$TPS_ON_OFF$,$TPS_ON_ALL_PANELLS$,$GANTT_CHART_ON$">
      <title>TPS Real-Time Activity Gantt Chart: = $TPS_Class_token$</title>
      <viz type="timeline_app.timeline">
        <search>
          <query>| tstats summariesonly=$summariesonly_token$ max(All_TPS_Logs.duration) AS All_TPS_Logs.duration FROM datamodel=MLC_TPS_DEBUG4 WHERE (nodename=All_TPS_Logs host=$host_token$) All_TPS_Logs.name =*$TPS_Class_token$* GROUPBY _time, All_TPS_Logs.$fullyQualifiedMethod_or_class$ span=1s | rename All_TPS_Logs.$fullyQualifiedMethod_or_class$ as opId | table _time opId All_TPS_Logs.duration</query>
          <earliest>$tps_selection.earliest$</earliest>
          <latest>$tps_selection.latest$</latest>
        </search>
        <option name="height">400</option>
        <option name="timeline_app.timeline.axisTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.colorMode">categorical</option>
        <option name="timeline_app.timeline.maxColor">#DA5C5C</option>
        <option name="timeline_app.timeline.minColor">#FFE8E8</option>
        <option name="timeline_app.timeline.numOfBins">6</option>
        <option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.useColors">false</option>
        <option name="charting.drilldown">false</option>
      </viz>
    </panel>
1 Solution

robertlynch2020
Influencer

Hi

I got an answer to this by changing the `

| tstats summariesonly=$summariesonly_token$

to

| tstats summariesonly=true

This seems to have a great performance effect.

View solution in original post

0 Karma

robertlynch2020
Influencer

Hi

I got an answer to this by changing the `

| tstats summariesonly=$summariesonly_token$

to

| tstats summariesonly=true

This seems to have a great performance effect.

0 Karma

niketn
Legend

@robertlynch2020, please convert your comment as answer and accept the same 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...