How can I improve dashboard time performance?

[maayan]

Hi,

My search base takes 13 sec to run but it takes more than 1 min for the dashboard to run. I use savedsearch func and it's still very slow. here is part of my dashboard (there are more charts, more filters and variables). Can you help me to improve the performance, please?

<form theme="light">
<label>Analysis Report</label>

<search id="AllQueries_Base">
<query> | loadjob savedsearch="mpazchen:search:joinWithLookup_Base"
| where $Mac_Address$ AND $WinTimeStamp$
</query>
</search>

<row>
<panel>
<input type="multiselect" token="WinTimeStamp" searchWhenChanged="true">
<label>Time</label>
<choice value="%">All</choice>
<default>%</default>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>(WinTimeStamp like("</valuePrefix>
<valueSuffix>"))</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>WinTimeStamp</fieldForLabel>
<fieldForValue>WinTimeStamp</fieldForValue>
<search base="AllQueries_Base">
<query> | where ( $Mac_Address$ )
| dedup WinTimeStamp
| sort WinTimeStamp</query>
</search>
</input>

<input type="multiselect" token="Mac_Address" searchWhenChanged="true">
<label>Mac Address</label>
<choice value="%">All</choice>
<default>%</default>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>(Mac_Address like("</valuePrefix>
<valueSuffix>"))</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Mac_Address</fieldForLabel>
<fieldForValue>Mac_Address</fieldForValue>
<search base="AllQueries_Base">
<query> | where ( $WinTimeStamp$ )
| dedup Mac_Address
| sort Mac_Address</query>
</search>
</input>
</panel>
</row>

<row>
<panel>
<single>
<search base="AllQueries_Base">
<query> | stats dc(HostName) as count_distinct_Machines </query>
</search>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="height">133</option>
<option name="rangeColors">["0xdc4e41","0x3c444d"]</option>
<option name="rangeValues">[0]</option>
<option name="trellis.enabled">0</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="underLabel">Machines</option>
</single>
</panel>

<panel id="CSSPanel4">
<single>
<search base="AllQueries_Base">
<query> | where Header_Type="Event" | stats count </query>
</search>

<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="height">133</option>
<option name="rangeColors">["0xdc4e41","0x3c444d"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="underLabel">Events</option>
</single>
</panel>

<panel id="CSSPanel5">
<single>
<search base="AllQueries_Base">
<query> | stats dc(source) </query>
</search>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="height">133</option>
<option name="rangeColors">["0xdc4e41","0x334457"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="underLabel">Files</option>
</single>
</panel>
</row>
<row>
<panel id="CSSPanel3">
<title>General events type distribution by time</title>
<chart>
<search base="AllQueries_Base">
<query>
| chart count over WinTimeStamp by Name | addtotals fieldname=total
</query>
</search><option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>
<option name="charting.axisTitleX.text">Day</option>
<option name="charting.axisTitleY.text">Number of events</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.backgroundColor">#f2f4f5</option>
<option name="charting.chart">column</option>
<option name="charting.chart.overlayFields">total</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>

<row>
<panel id="CSSPanel11">
<title>General events type distribution</title>
<chart>
<search base="AllQueries_Base">
<query>
|stats count by Name
|sort -count</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">all</option>
<option name="charting.backgroundColor">#f2f4f5</option>

<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel id="CSSPanel2">
<title>Top 10 events count by machine</title>
<chart>
<search base="AllQueries_Base">
<query>
| chart count over HostName by Name | addtotals fieldname=total| sort -total | head 10
</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>
<option name="charting.axisTitleY.text">Number of events</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.backgroundColor">#f2f4f5</option>
<option name="charting.chart">column</option>
<option name="charting.chart.overlayFields">total</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel id="CSSPanel14">
<single>
<search base="AllQueries_Base">
<query> | chart count over HostName| stats avg(count) AS AVERAGE_Events_Per_User</query>
</search>

<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="height">137</option>
<option name="numberPrecision">0.0</option>
<option name="rangeColors">["0xdc4e41","0x334457"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="underLabel">Average Events by Machine</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel id="CSSPanel10">
<html>
<center>
<h1> </h1>
</center>
</html>
</panel>
</row>

<row>
<panel id="CSSPanel1">
<html>
<center>
<h1 style="color:white;"> WiFi Successful And Failed Connection Events</h1>
</center>
</html>
</panel>
</row>
<row>
<panel>
<title>Connection Type</title>
<chart>
<search base="AllQueries_Base">
<query>
<!--| where Name="Wi-Fi Successful Connection" OR Name="Wi-Fi Failed Connection"-->
|stats count by "Connection_Type"
|sort -count</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>


</chart>
</panel>
</row>
</form>

[gcusello]

Hi @maayan,

you have three solution to improve your dashboard performace:

• accelerating you main search (but there some restriction, so probably it isn't applicable to you use case)(https://docs.splunk.com/Documentation/Splunk/latest/Report/Acceleratereports),
• using a summary index (https://lantern.splunk.com/Splunk_Platform/Product_Tips/Searching_and_Reporting/Using_summary_indexi...),
• using an accelerated DataModel (https://docs.splunk.com/Documentation/Splunk/9.0.5/Knowledge/Acceleratedatamodels).

There's also this my old answer https://community.splunk.com/t5/Splunk-Search/How-to-accelerate-searches-in-dynamic-dashboard/m-p/22... still usable 

Ciao.

Giuseppe