Splunk Enterprise

help on a dashboard performances

jip31
Motivator

hi

I use a dashboard with 17 panels (12 single panels and 5 table panels) that works in real-time

In this case, real time means that I can use scheduled serarch because I need to have the last events every time I launch my dashboard

By default, my timepicker is on the last 24 hours

The index is always the same but I use 10 different sourcetype

I must imperatively use real time

Most of the time I use post process search in order to avoid to query the index and the sourcetype many times

The problem I have is a slow display, sometimes it works almost fine and most of the time I have a message "waiting for data" or "waiting for queued job to start"

I also think that since 2 days there is slowness issues behind indexers because I have tested other dashboards and they are slow too..

What are best practices for dashboard in real time please?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Searching over a 24-hour time window means this is not a real-time dashboard.  Real-time searches display events as soon as they arrive whereas this dashboard has to be re-run to detect new events.

A dashboard that is "waiting for data" is waiting for results to come back from the indexers.  The delay could be caused by an inefficient search, by a large quantity of data being searched, or by indexers that are too busy.

The "waiting for queued job to start" message means there are other searches taking place and the dashboard has to wait for resources to be available.  That can happen when the dashboard runs at a busy time, like the top of an hour.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Searching over a 24-hour time window means this is not a real-time dashboard.  Real-time searches display events as soon as they arrive whereas this dashboard has to be re-run to detect new events.

A dashboard that is "waiting for data" is waiting for results to come back from the indexers.  The delay could be caused by an inefficient search, by a large quantity of data being searched, or by indexers that are too busy.

The "waiting for queued job to start" message means there are other searches taking place and the dashboard has to wait for resources to be available.  That can happen when the dashboard runs at a busy time, like the top of an hour.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>