Dashboards & Visualizations

What is the expected load time of a dashboard studio page in view mode, with only using saved searches?

thomas_brunner
Explorer

What is the expected load time of a dashboard studio page in view mode, with only using saved searches?

In our environment we have a dashboard page with ~140 Choropleth SVG Items, each colored by a savedsearch.

When loading/reloading the page, it takes 6 seconds for the overal splunk page to load, another 6 seconds to load all our SVGs and another 2 to color them.

Resulting in ~14.5 seconds to load that page in total. This is running with Splunk 9.1.0.2 on an Environment with dedicated SearchHeads and Indexers on virtual machines, all NVMe Storage, plenty of RAM, ...

Using a more simple dashboard (<5 SVG items and an table with a live search), the total page is loaded within 5 seconds.

 

Is this the expected performance? Are there any performance tweaks we could do? Things we should check/change/...?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

By "saved search" do you mean you are loading the results from a previously executed search, or re-running the search with substituted values?

SVG is rendered in the browser, so your server configuration makes little difference here; you could try upgrading your browser environments?

View solution in original post

thomas_brunner
Explorer

By "saved search" I mean that the used searches in the Dasboard are all "ds.savedSearch", which are updated by a cron schedule. So i would expect loading results from previously executed searches.

Browser is Firefox 102.10.0esr and also with an up to date Chrome we see the same issue. And by SVGs we are talking about simple boxes with a Text.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

By "saved search" do you mean you are loading the results from a previously executed search, or re-running the search with substituted values?

SVG is rendered in the browser, so your server configuration makes little difference here; you could try upgrading your browser environments?

thomas_brunner
Explorer

By packing all the small SVG graphs into one big one (so only one SVG for the whole dashboard with 140 subitems), the load times have drastically reduced and are now again at 4-5 seconds (which is still long, but seems to be normal with Splunk).

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...