Splunk Dashboard using panels - Performance issue during loading

[ganeshkumarmoha]

Hi Team,
I am developing Splunk dashboard to provide the weekly restart status of all enterprise application servers. Since this dashboard is intended to show the restart status for last 7 days of huge server count, totally 18 panels have been developed and using <condition match="****> option, I am hiding/un-hiding these panels for last 7 years.

During validation, there's a delay in loading the panels due to performance factor and I am not sure, whether design approach followed is correct or not. Kindly advise how to effective improve the response time while loading the panels.

[richgalloway · Accepted solution]

Eighteen panels is a lot for a dashboard.  A good rule of thumb is keep the dashboard size to a single screen.

Even though the panels are hidden the searches still run.  Prevent them from running by putting a token in the query.  The search won't run until the token is defined.

Seven years is a lot to search.  Is it really necessary to go through that much data?  The single best way to improve the performance of a search is to limit the search window.  If that much data is needed then consider creating a summary index for it to help improve performance.

[ganeshkumarmoha]

Thanks rickgalloway for quick response.

Sorry, its typo error --> I need to display for last 7 days ONLY (BUT, NOT for 7 years)