Dashboards & Visualizations

What is the expected load time of a dashboard studio page in view mode, with only using saved searches?

thomas_brunner
Explorer

What is the expected load time of a dashboard studio page in view mode, with only using saved searches?

In our environment we have a dashboard page with ~140 Choropleth SVG Items, each colored by a savedsearch.

When loading/reloading the page, it takes 6 seconds for the overal splunk page to load, another 6 seconds to load all our SVGs and another 2 to color them.

Resulting in ~14.5 seconds to load that page in total. This is running with Splunk 9.1.0.2 on an Environment with dedicated SearchHeads and Indexers on virtual machines, all NVMe Storage, plenty of RAM, ...

Using a more simple dashboard (<5 SVG items and an table with a live search), the total page is loaded within 5 seconds.

 

Is this the expected performance? Are there any performance tweaks we could do? Things we should check/change/...?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

By "saved search" do you mean you are loading the results from a previously executed search, or re-running the search with substituted values?

SVG is rendered in the browser, so your server configuration makes little difference here; you could try upgrading your browser environments?

View solution in original post

thomas_brunner
Explorer

By "saved search" I mean that the used searches in the Dasboard are all "ds.savedSearch", which are updated by a cron schedule. So i would expect loading results from previously executed searches.

Browser is Firefox 102.10.0esr and also with an up to date Chrome we see the same issue. And by SVGs we are talking about simple boxes with a Text.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

By "saved search" do you mean you are loading the results from a previously executed search, or re-running the search with substituted values?

SVG is rendered in the browser, so your server configuration makes little difference here; you could try upgrading your browser environments?

thomas_brunner
Explorer

By packing all the small SVG graphs into one big one (so only one SVG for the whole dashboard with 140 subitems), the load times have drastically reduced and are now again at 4-5 seconds (which is still long, but seems to be normal with Splunk).

 

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...