Deployment Architecture

My searchhead is slow since I update from 6 to 7.2.3

Explorer

Hello,

since I update my Splunk search head from 6 to 7.2.3, the display of the dashboards are very slow.
In fact, all the action are slowed than the anterior version.
But my index are the same and the upgrade has been done with no error.

Any clues about that ?

Regards,
Alaza

0 Karma
1 Solution

Ultra Champion

Many of the 7.2.x versions had a number of memory and CPU implications (trust me - I think we found each and every one)
7.2.4 addresses all of the tickets and bugs we had open, and so far it does appear to be significantly better than 7.2.3.

View solution in original post

Ultra Champion

Many of the 7.2.x versions had a number of memory and CPU implications (trust me - I think we found each and every one)
7.2.4 addresses all of the tickets and bugs we had open, and so far it does appear to be significantly better than 7.2.3.

View solution in original post

Path Finder

I have a similar issue after upgrading from 6.6.0 to 7.2.1. We noticed the slowness is present in searches with a lot of append operations. In some cases searches that previously took few seconds, now take 10+ minutes.
Analyzing search.log we pinpointed the issue to be on the search optimization. Disabling search optimizatiion appending | noop search_optimization=false to the query partially solves the problem (the search is slower than before, but at least acceptable).

0 Karma

Champion

Which was previous splunk version, 6.0?

0 Karma

Path Finder

In my case from 6.6.11 to 7.2.3

0 Karma

Explorer

It was the 6.6.3.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!