All Apps and Add-ons

Timeline graph slow in rendering for large data

AKG1_old1
Builder

Hello,

I am using Time line in my dashboard. In case of large data say 10k, it takes 2-3 minutes to render on screen. Eventhough my query finished in only 1 sec. Even my whole dashboard freeze during rendering.

Is there any workaround for this issue ?

Timeline App Version = 1.1.0

Search Query:

| tstats summariesonly=true max(All_TPS_Logs.duration) AS duration max(All_TPS_Logs.context.id) AS ID values(All_TPS_Logs.Engine_ID) AS Engine_ID values(All_TPS_Logs.no_of_threads) AS No_of_Threads values(All_TPS_Logs.operationIdentity) AS operationIdentity FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=Luas_TestCampaign_PI9 All_TPS_Logs.operationIdentity="*processBatch*" All_TPS_Logs.Engine_ID = "196") GROUPBY All_TPS_Logs.riskGroup, _time span=1s
| rename All_TPS_Logs.riskGroup as riskGroup
| makemv riskGroup delim="\s" 
| eval RiskGroup_ID=riskGroup."_".ID
| sort 0 _time
| table _time RiskGroup_ID No_of_Threads duration

alt text

0 Karma

bandit
Motivator

Try moving your where clause before the first pipe, right before the FROM datamodel syntax. This should cause fewer records to be returned from the first part of the query. If that doesn't work, try pasting your full query as it's hard to see from just the screenshot.

AKG1_old1
Builder

@rob_jordan : thanks for reply. I have added search query in question. I have changed where clasue as you suggested but it doen't make much difference. If I convert results in table then its really quick. I think issue is with Timeline chart. we are using Timeline is few other dashboards and all of them are slow for large data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...