Splunk Enterprise

help on a dashboard performances

jip31
Motivator

hi

I use a dashboard with 17 panels (12 single panels and 5 table panels) that works in real-time

In this case, real time means that I can use scheduled serarch because I need to have the last events every time I launch my dashboard

By default, my timepicker is on the last 24 hours

The index is always the same but I use 10 different sourcetype

I must imperatively use real time

Most of the time I use post process search in order to avoid to query the index and the sourcetype many times

The problem I have is a slow display, sometimes it works almost fine and most of the time I have a message "waiting for data" or "waiting for queued job to start"

I also think that since 2 days there is slowness issues behind indexers because I have tested other dashboards and they are slow too..

What are best practices for dashboard in real time please?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Searching over a 24-hour time window means this is not a real-time dashboard.  Real-time searches display events as soon as they arrive whereas this dashboard has to be re-run to detect new events.

A dashboard that is "waiting for data" is waiting for results to come back from the indexers.  The delay could be caused by an inefficient search, by a large quantity of data being searched, or by indexers that are too busy.

The "waiting for queued job to start" message means there are other searches taking place and the dashboard has to wait for resources to be available.  That can happen when the dashboard runs at a busy time, like the top of an hour.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Searching over a 24-hour time window means this is not a real-time dashboard.  Real-time searches display events as soon as they arrive whereas this dashboard has to be re-run to detect new events.

A dashboard that is "waiting for data" is waiting for results to come back from the indexers.  The delay could be caused by an inefficient search, by a large quantity of data being searched, or by indexers that are too busy.

The "waiting for queued job to start" message means there are other searches taking place and the dashboard has to wait for resources to be available.  That can happen when the dashboard runs at a busy time, like the top of an hour.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...