Splunk UI is very slow

[rsruthi48]

I'm trying to learn Splunk and i installed the Splunk Free trial version 9.1.2

I've been using this free version for over a month now and 2weeks ago i ingested Botsv1 and Botsv2 datasets into Splunk along with the recommended add-ons. Up until yesterday I did not face any slowness and suddenly today Splunk is very unresponsive, every click takes almost 2mins to load. 

I checked my resources and there is no issue there, my memory is at 50% usage since Day-1 I installed Splunk and there is also 100GB of free space available in my C:\. I'm only using Splunk as a Search-Head so I'm not performing any complex activities for it to get this slow. 

Any suggestions to improve its speed?

[isoutamo]

You should use some more recent version than 9.1. It's already out of support phase. See https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core

Please try e.g. 9.4.4 which should be quite ok for testing and production use.

Those bots version are also old and especially TA's etc. which it's used are also outdated and even archived.

There is also bots.splunk.com where you can training some use cases with guides.

[livehybrid]

Hi @rsruthi48 

Generally speaking Splunk uses most of its resources when either indexing new data, or searching data. If you are just navigating around the UI it shouldnt use too much resource and definitely wouldn't expect it to degrade over time. 

Please could you try accessing using Incognito mode to see if that makes a difference? Also its worth checking the logs in $SPLUNK_HOME/var/log/splunk/splunkd.log to see if there are any obvious errors relating to the pages being loaded. 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[rsruthi48]

Hi livehybrid

Restarting Splunk worked.