Splunk dashboard performance issue- Which one is better for performance tuning?

[supraja]

Hi Team,

kindly let us know which one is better for performance tuning. Dashboard taking so much time to load.

index=abc "DONE"

or 

index=abc myfield="DONE"

[gcusello]

Hi @supraja,

in general, as @bowesmana said, you could see in the Job inspector where are the bottlenecks in your search, but you should also analyze your searches:

• are you using join or transaction commands?
• are there in your dashboards many panels?
• are there more panels that use the same search, different only for the last part of the search?
• have you a performant architecture in termes of reference hardware and storage performaces?

If you use transaction or join commands, you have to modify your searches to replace these commands with other solution (e.g. stats) because Splunk isn't a BD and these commands must be used only if you haven't any other solution.

If you have too many panels, you could divide your dashboard in two o three.

if you nave many panels with a similar search, you could use the Post Process Search, for more details see https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches?_gl=1*1ysw50k*_ga*MTM1ODgwOTE3... 

If you could share your dashboard we could help you to analyze it.

Ciao.

Giuseppe

[bowesmana]

Look at the job inspector - it will show you how long each variant takes. 

There are many things to assessing performance - run your searches in isolation and the job inspector will help you - if you still have an issue, post your real search here