Splunk Search

How can I tune the splunk flash chart drawing?

melonman
Motivator

Hi there,

I have a chart that takes 15+ sec to draw area graph after loading completed. Loading data can be tuned by using summary index, but any way to tune drawing part? The number of data is around 9000 * 3 series.

Thank you!

Tags (1)
0 Karma
1 Solution

melonman
Motivator

I just did simple modification span=5min to span=60min. It changed a lot actually. It took 20sec with span=5min v.s. 4sec with span=60min. I noticed that most of the time taken was flash drawing part as I watched my browser.

Thanks.

View solution in original post

0 Karma

melonman
Motivator

I just did simple modification span=5min to span=60min. It changed a lot actually. It took 20sec with span=5min v.s. 4sec with span=60min. I noticed that most of the time taken was flash drawing part as I watched my browser.

Thanks.

0 Karma

melonman
Motivator

I just did simple modification span=5min to span=60min. It changed a lot actually. It took 20sec with span=5min v.s. 4sec with span=60min. I noticed that most of the time taken was flash drawing part as I watched my browser. Thanks.

0 Karma

melonman
Motivator

I will simplify the question. I have performance data of CPU/Memory/Disk utilization. Those data is gathered every 5 min. I have been asked to create one timechart based on the following search string:

.. earliest=-1mon@mon latest=@mon | timechart span=5min avg(CPU) avg(Memory) avg(Disk)

I don't thing summary indexing for this doesn't improve the performance because there is span=5min and the data used is gathered every 5min.

Is there any performance tuning method in this case?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...