How can I tune the splunk flash chart drawing?

[melonman]

Hi there,

I have a chart that takes 15+ sec to draw area graph after loading completed. Loading data can be tuned by using summary index, but any way to tune drawing part? The number of data is around 9000 * 3 series.

Thank you!

[melonman · Accepted solution]

I just did simple modification span=5min to span=60min. It changed a lot actually. It took 20sec with span=5min v.s. 4sec with span=60min. I noticed that most of the time taken was flash drawing part as I watched my browser.

Thanks.

[melonman]

I just did simple modification span=5min to span=60min. It changed a lot actually. It took 20sec with span=5min v.s. 4sec with span=60min. I noticed that most of the time taken was flash drawing part as I watched my browser. Thanks.

[melonman]

I will simplify the question. I have performance data of CPU/Memory/Disk utilization. Those data is gathered every 5 min. I have been asked to create one timechart based on the following search string:

.. earliest=-1mon@mon latest=@mon | timechart span=5min avg(CPU) avg(Memory) avg(Disk)

I don't thing summary indexing for this doesn't improve the performance because there is span=5min and the data used is gathered every 5min.

Is there any performance tuning method in this case?