Folks finding 6x as snappy as 5x?

[Runals]

We have a pretty large (?) environment that we just upgraded from 5.0.5 to 6.0.2 and would anecdotally say 6 isn't quite as snappy as 5. In this context I'm saying snappy in terms of quickness to respond to running a query, opening dashboards, other UI sorts of things. For example ad-hoc queries usually say "Parsing search" for anywhere from 1 to 10 seconds before actually executing the search. In the scope of life that is nothing but it is a change and from a user's perspective anything above 4 or 5 seconds is "a long time." If we had never used 5 we wouldn't know the difference 🙂

For context we have 20 indexers and are bringing in about 1.5TB/day. We saw some relief from disabling THP across the board on our indexers and SH (all openSuse) but still not back to 5x speeds.

We do have a ticket open with support and there are no lack of variables but was curious if others are having similar observations. In our case the only real variable that changed was moving to 6.

[hexx]

There is a bug specific to Simple XML dashboards introduced in 6.0 (reference: SPL-80944) that can lead to notable UI performance degradation, particularly in search-head pooling environments and with dashboards that contain many panels.

The fix for this bug is currently slated for maintenance release 6.0.3, but if you believe that you are experiencing this issue please contact Splunk Support, reference this bug and ask for a patch to work around it.

[jgreenleaf]

We don't use simple xml dashboards (we convert them all to advanced xml before deploying them) and have noticed a dramatic performance improvement with splunk 6.

[LukeMurphey]

We have noticed that the performance profile seems different in 6.0 versus 5.x in the following ways:

1. The user interface in 6.0.x seems to have an initial delay of a few seconds that 5.0.x didn't have.
2. 6.0.x seems to scale much better overall. It's performance remains more consistent as you add more data where 5.0.x seems to slowdown more.