Dashboards & Visualizations

speeding up splunk dashboard load time

aaronkorn
Splunk Employee
Splunk Employee

What is the best approach to speed up dashboard load times? Most of our searches are inline and have to sift through massive amounts of data for about an 8 Hr window. Would saved searches be the recommended way to go to speed up the times or is there a way to cache the search results so it loads quicker the next time. We previously had a realtime dashboard but it used so much cpu/memory that we removed that and we just refresh the dashboard every 10 min.

Thanks!

0 Karma

Ayn
Legend

Well saved searches WOULD be how you would cache results. Have a saved search run on a scheduled and then set a TTL on its results so that the dashboard always can grab fresh cached results. For instance you could run the saved search every 30 minutes and have a TTL of 35 minutes or so...or whatever time is acceptable to lag behind. Then configure your dashboard accordingly so it uses these cached results from the saved search rather than using inline searches which always have to run right when the user loads the dashboard.

Other alternatives you could consider are summary indexing and report acceleration (I don't have much experience with the latter so I can't really say how well it could apply to your situation).

BenjaminWyatt
Communicator

Just change the module from "HiddenSearch" to "HiddenSavedSearch" and adjust the params accordingly (you can look at the module reference to see the differences).

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

how do you configure the dashboard to use the cached results?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

You can read about summary indexing and report acceleration in the Knowledge Manager Manual: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutsummaryindexing

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...