My searchhead is slow since I update from 6 to 7.2.3

[Alaza]

Hello,

since I update my Splunk search head from 6 to 7.2.3, the display of the dashboards are very slow.
In fact, all the action are slowed than the anterior version.
But my index are the same and the upgrade has been done with no error.

Any clues about that ?

Regards,
Alaza

[nickhills · Accepted solution]

Many of the 7.2.x versions had a number of memory and CPU implications (trust me - I think we found each and every one)
7.2.4 addresses all of the tickets and bugs we had open, and so far it does appear to be significantly better than 7.2.3.

[marios_kstone]

I have a similar issue after upgrading from 6.6.0 to 7.2.1. We noticed the slowness is present in searches with a lot of append operations. In some cases searches that previously took few seconds, now take 10+ minutes.
Analyzing search.log we pinpointed the issue to be on the search optimization. Disabling search optimizatiion appending | noop search_optimization=false to the query partially solves the problem (the search is slower than before, but at least acceptable).

[p_gurav]

Which was previous splunk version, 6.0?

[aecruzp]

In my case from 6.6.11 to 7.2.3

[Alaza]

It was the 6.6.3.