Sounds like your system is being overloaded when the dashboard is loaded. If the install is on linux you can look to see how many searches are running, ps -ax | grep splunkd, also the top command will show you any load that is going on. Another search I would also check your metrics.log for any blocked queues. Search for "blocked=true" ... View more

I think your event merging problem would be solved with the following props.conf entry: [I2] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = ^\d{4}/\d\d/\d\d \d\d:\d\d:\d\d - BREAK_ONLY_BEFORE_DATE = False The BREAK_ONLY_BEFORE_DATE is True by default (despite what the docs say), which can cause your issues here because multiple dates are present. (You could also potententially solve this by specifying TIME_FORMAT ). Also notice that your BREAK_ONLY_BEFORE regex was incorrect. You have a 4 digit year, not a 2 digit one. The regex above should work. If you want splunk to use your second timestamp you have a couple of options. However, the sample you provided hasn't given enough context to know for sure what comes before your second date. (Your first sample has 3 different dates, two of which are the same, and then). Does the 2nd date always occur after the word "from"? In your example the two dates are from different years, which also seems weird. (You can edit your question and add a few more lines which shoudl be enough to establish a pattern) There are a couple of helpful docs on this topic too: How timestamp assignment works Configure timestamp assignment for events with multiple timestamps ... View more