Concurrent Search calculation for platform designing and sizing.

[SagarSplunk]

We have requirement to build Single Master dashboard for a transaction monitoring. Dashboard will be collection of 6 child dashboards.

Each individual dashboard will have separate search queries as given below

Search query 1 to calculate to display overlay chart for average response time for transaction for last 12 hrs.
Search query 2 calculate Average response time.
Search query 3 to calculate Total Count of transactions in Last 5 minutes
Search query 4 to calculate % transactions Missed SLA’s in last 5 minutes

Refresh rate for Dashboard is 20 Seconds.

Question:-
How many concurrent searches will be running for 6 child Dashboards, Do we have any document from splunk where we can calculate it. It will help us in platform designing.

Below is the calculation which I made

My Assumption please correct if I am wrong
Each Child Dashboard will have 4-5 Concurrent Searches, total count for concurrent searches will be 6X5= ~30 for Single Master Dashboard.

[woodcock]

You can almost certainly run all of those panels from a single base search and build each panel with a post-process search:

http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/Savedsearches#Post-process_searches_2

[jkat54]

If you mean that the child dashboards are "panels" on a dashboard, then yes your calculation is correct assuming the load time for each search is 20s. Otherwise if it takes longer or shorter time to load the panel then it could be constantly running and also over-running. or perhaps the searches all complete in 1 second making it so you're only running 30 searches for 1 second out of every 20 seconds which technically averages to 1.5 concurrent searches when factored over a period of time equal divisibl by 20seconds (30/20 = 1.5) however you will expect these all kick off at the same time producing a time when 30 concurrent searches are being produced by this one dashboard.

My advice is never put more than 5 searches on a dashboard. Anything that's "below the fold" (a web design term of sorts) is usually ignored or not even noticed. And a dashboard with 30 widgets all above the fold is typically too busy to draw meaningful value from it. Now, that being said you will find plenty of dashboards out there with pages of panels and tons of detail. Even dashboards created by Splunk themselves. But please be aware that we cant all be great UX developers, nor can the boss man who is asking you to create such a busy dashboard be aware of all these things that are considered "best practices" when it comes to User eXperience.