Dashboards & Visualizations

speeding up splunk dashboard load time

aaronkorn
Splunk Employee
Splunk Employee

What is the best approach to speed up dashboard load times? Most of our searches are inline and have to sift through massive amounts of data for about an 8 Hr window. Would saved searches be the recommended way to go to speed up the times or is there a way to cache the search results so it loads quicker the next time. We previously had a realtime dashboard but it used so much cpu/memory that we removed that and we just refresh the dashboard every 10 min.

Thanks!

0 Karma

Ayn
Legend

Well saved searches WOULD be how you would cache results. Have a saved search run on a scheduled and then set a TTL on its results so that the dashboard always can grab fresh cached results. For instance you could run the saved search every 30 minutes and have a TTL of 35 minutes or so...or whatever time is acceptable to lag behind. Then configure your dashboard accordingly so it uses these cached results from the saved search rather than using inline searches which always have to run right when the user loads the dashboard.

Other alternatives you could consider are summary indexing and report acceleration (I don't have much experience with the latter so I can't really say how well it could apply to your situation).

BenjaminWyatt
Communicator

Just change the module from "HiddenSearch" to "HiddenSavedSearch" and adjust the params accordingly (you can look at the module reference to see the differences).

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

how do you configure the dashboard to use the cached results?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

You can read about summary indexing and report acceleration in the Knowledge Manager Manual: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutsummaryindexing

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!