Building for the Splunk Platform

How to resolve Load issues while using Splunkjs stack for app running outside of Splunk?

pgoldweic
Communicator

We created an application (mostly Javascript, with a proxy server for communicating to Splunk) that, while running outside of Splunk,  accesses Splunk Enterprise data and displays Splunkjs visualizations (using the docs at https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usesplunkjsstack/ ). Unfortunately we seem to be running into load-related issues when several users simultaneously access it, as follows:

  • 1 - Incomplete chart displays ('waiting for data'  forever) in a couple of charts that happen to depend on the completion of saved searches for their own (post process) search to get started.
  • 2 - Other times, this error appears in the Javascript console and none of the charts load:

       Uncaught Error: Load timeout for modules: splunkjs/ready!_unnormalized2,splunkjs/ready!http://requirejs.org/docs/errors.html#timeout    at makeError (eval at module.exports (config.js:138), <anonymous>:166:17)    at checkLoaded (eval at module.exports (config.js:138), <anonymous>:692:23)    at eval (eval at module.exports (config.js:138), <anonymous>:713:25)

NOTE: these issues don’t come up unless there are various simultaneous (10 or so is all that it requires) loads of the application, which is why we are theorizing that they are load-related issues. In addition, our Splunk admin was present when we tested this app, and he did not see the relevant limits being reached on the back end (e.g. number of simultaneous searches, space used by the single service user employed in this application) .

Could somebody please advise on what could be happening? Are there limitations specific to the Splunkjs stack that we should be aware of?   

 

Labels (1)
Tags (1)
1 Solution

pgoldweic
Communicator

Hi @eliav2 , yes, I should have updated this post a while ago but forgot to do so. Essentially, what I discovered was that the javascript 'require' call (which I mention above in the post) was timing out when several Splunk queries were being access simultaneously.  This in particular, is not a Splunk limitation, but a timing limitation in that function. I was able to temporarily do away with this timeout by changing the parameters being passed to 'require'. Specifically, I ended up with this call:

       // Configure the web site's base URL
      require.config({
      baseUrl: "static/",
      waitSeconds: 0
      });

Note the 'waitSeconds' value above., which would normally not be included. 

Ultimately though, I ended up understanding the reality that Splunk's performance is the real culprit when writing this type of applications, and I did what I could to 'optimize' the queries that I was running simultaneously  on one web page (even sequencing some of them to avoid some of the concurrency).  This continues to be an issue for us and we haven't really found a good solution to the problem in general. If you find out some other way  please post it here.  Good luck with your optimization!

View solution in original post

0 Karma

pgoldweic
Communicator

Hi @eliav2 , yes, I should have updated this post a while ago but forgot to do so. Essentially, what I discovered was that the javascript 'require' call (which I mention above in the post) was timing out when several Splunk queries were being access simultaneously.  This in particular, is not a Splunk limitation, but a timing limitation in that function. I was able to temporarily do away with this timeout by changing the parameters being passed to 'require'. Specifically, I ended up with this call:

       // Configure the web site's base URL
      require.config({
      baseUrl: "static/",
      waitSeconds: 0
      });

Note the 'waitSeconds' value above., which would normally not be included. 

Ultimately though, I ended up understanding the reality that Splunk's performance is the real culprit when writing this type of applications, and I did what I could to 'optimize' the queries that I was running simultaneously  on one web page (even sequencing some of them to avoid some of the concurrency).  This continues to be an issue for us and we haven't really found a good solution to the problem in general. If you find out some other way  please post it here.  Good luck with your optimization!

0 Karma

eliav2
Engager

same here... any update how to avoid this splunkjs/ready! load error?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...