Dashboards & Visualizations

What is the expected load time of a dashboard studio page in view mode, with only using saved searches?

thomas_brunner
Explorer

What is the expected load time of a dashboard studio page in view mode, with only using saved searches?

In our environment we have a dashboard page with ~140 Choropleth SVG Items, each colored by a savedsearch.

When loading/reloading the page, it takes 6 seconds for the overal splunk page to load, another 6 seconds to load all our SVGs and another 2 to color them.

Resulting in ~14.5 seconds to load that page in total. This is running with Splunk 9.1.0.2 on an Environment with dedicated SearchHeads and Indexers on virtual machines, all NVMe Storage, plenty of RAM, ...

Using a more simple dashboard (<5 SVG items and an table with a live search), the total page is loaded within 5 seconds.

 

Is this the expected performance? Are there any performance tweaks we could do? Things we should check/change/...?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

By "saved search" do you mean you are loading the results from a previously executed search, or re-running the search with substituted values?

SVG is rendered in the browser, so your server configuration makes little difference here; you could try upgrading your browser environments?

View solution in original post

thomas_brunner
Explorer

By "saved search" I mean that the used searches in the Dasboard are all "ds.savedSearch", which are updated by a cron schedule. So i would expect loading results from previously executed searches.

Browser is Firefox 102.10.0esr and also with an up to date Chrome we see the same issue. And by SVGs we are talking about simple boxes with a Text.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

By "saved search" do you mean you are loading the results from a previously executed search, or re-running the search with substituted values?

SVG is rendered in the browser, so your server configuration makes little difference here; you could try upgrading your browser environments?

thomas_brunner
Explorer

By packing all the small SVG graphs into one big one (so only one SVG for the whole dashboard with 140 subitems), the load times have drastically reduced and are now again at 4-5 seconds (which is still long, but seems to be normal with Splunk).

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...