How to speed up the dashboards

[xvxt006]

Hi,

We have few dashboards with more than 10 widgets and it takes lot of time to load these. is there a way to speed these up? i have tried accelerating the searches but not much of improvement. i don't know if acceleration is working or not. Any suggestions?

[aweitzman]

Without seeing the searches you're doing, it's hard to say exactly. I've had very good success with @tom_frotscher's acceleration approach.

Depending on the actual searches, you might also be able to take advantage of post-processing. If you have one reporting search that's a common ancestor of a couple of the widgets on your dashboard, you can do the reporting search once, and then build the remaining searches on top of that result. Even though they attempt to run concurrently, they're each doing a lot less work (since the reporting search is only done once for the whole dashboard), so they should take less time overall. I had a dashboard where I restructured a bunch of widgets to post-process off a reporting search instead of each one deriving stats from a similar event search. It got a little tricky, but in the end the amount of work overall for the dashboard was reduced and it loaded noticeably faster.

Finally, you might want to consider splitting your dashboard in two and having fewer searches per dashboard.

Good luck.

[Runals]

It almost sounds like you have a concurrent searches issue. For a standard user role I think the default is 3 meaning Splunk will do 3 searches and queue up the rest. The wrinkle in that is if you are using Splunk 6x and the searches in the dashboard are saved vs inline. If they are saved they will run with the permission set of the person who created/owns them.

The other thing you can do is tell Splunk to update the searches periodically vs on load. I haven't done that in ages and am not able to get at my Splunk instance right now so can't look it up.

[tom_frotscher]

It is not so easy to answer this question without more information. But there are several ways to speed up your dashboards. For example you can schedule the searches used on the dashboard. On this way the user who loads the dashboard will not trigger new search processes for every search used. Instead he will see cached results from the last scheduled run.

There are additional ways like summary indexing or the mentioned accelration.

You can see if your acceleration is used by going to settings -> Report acceleration summaries -> under the column access count.

[xvxt006]

Thank you all. I think these are valuable suggestions.