Dashboards & Visualizations

Performance issue with auto-refreshing dashboard

hcheang
Path Finder

Hi,

We are sharing multiple dashboards with clients which are automatically refreshing every 5 minutes.
The problem is that from time to time, the dashboard doesn't display panels properly as shown below
alt text
!Is there something wrong with the xml code or is it simply a performance issue? We have added new indexer which should have enhanced the performance of Splunk but we are not experiencing any difference. Is there a query to check the performance degradation before and after?

0 Karma

muebel
SplunkTrust
SplunkTrust

If you are concerned about Splunk performance the best thing to do would be to implement the Splunk on Splunk app, or Distributed Management Console.

0 Karma

jeffland
SplunkTrust
SplunkTrust

I would assume this is performace related since it only fails from time to time. Adding indexers is perhaps not the only way to deal with high performance needs due to a higher number of users, remeber that the search heads also play a role in this (assuming you have a distributed environment).

Have you had a look at your internal indexes and at individual searches to see which parts of your system are pressured most/take the longest?

0 Karma

hcheang
Path Finder

Also, what am I supposed to look for regarding performance issue on internal index logs?

0 Karma

jeffland
SplunkTrust
SplunkTrust

I would suggest you have a look here for an overview of what you can find. Unfortunately I can't hint you directly at every possible cause, but I would imagine that it's best to have a look at the metrics.log - this log contains many important, well, "metrics" about your splunk instance 😉

Of course, checking for client-side issues is always a good idea. Switching to another browser is an easy first step to determine if the first one is the cause!

hcheang
Path Finder

Thanks! I'll see what I can find!

0 Karma

hcheang
Path Finder

I haven't check internal indexes but I think I found the issue. We are using FireFox as our default browser and it is consuming 80% of physical memory on average. If shifting tabs or queries I type appear a minute later, it is issue with the browser and RAM, right?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...