What is the expected load time of a dashboard studio page in view mode, with only using saved searches?

[thomas_brunner]

What is the expected load time of a dashboard studio page in view mode, with only using saved searches?

In our environment we have a dashboard page with ~140 Choropleth SVG Items, each colored by a savedsearch.

When loading/reloading the page, it takes 6 seconds for the overal splunk page to load, another 6 seconds to load all our SVGs and another 2 to color them.

Resulting in ~14.5 seconds to load that page in total. This is running with Splunk 9.1.0.2 on an Environment with dedicated SearchHeads and Indexers on virtual machines, all NVMe Storage, plenty of RAM, ...

Using a more simple dashboard (<5 SVG items and an table with a live search), the total page is loaded within 5 seconds.

Is this the expected performance? Are there any performance tweaks we could do? Things we should check/change/...?

[thomas_brunner]

By "saved search" I mean that the used searches in the Dasboard are all "ds.savedSearch", which are updated by a cron schedule. So i would expect loading results from previously executed searches.

Browser is Firefox 102.10.0esr and also with an up to date Chrome we see the same issue. And by SVGs we are talking about simple boxes with a Text.

[ITWhisperer · Accepted solution]

By "saved search" do you mean you are loading the results from a previously executed search, or re-running the search with substituted values?

SVG is rendered in the browser, so your server configuration makes little difference here; you could try upgrading your browser environments?

[thomas_brunner]

By packing all the small SVG graphs into one big one (so only one SVG for the whole dashboard with 140 subitems), the load times have drastically reduced and are now again at 4-5 seconds (which is still long, but seems to be normal with Splunk).