Symptoms
- Dashboard panels take more than 10 seconds to render.
- Spinning indicators persist on the Executive Summary or Scoreboard.
- "Search timed out" messages appear in panel headers.
Causes
Slow dashboards are almost always caused by one of these issues:
- Data model acceleration not enabled — Patronus relies heavily on accelerated data models for performance.
- Large lookup tables without optimization — Asset or identity lookups over 100k rows need special handling.
- Insufficient search concurrency — Too many concurrent searches competing for resources.
Solution
1. Enable Data Model Acceleration
Navigate to Settings → Data Models in Splunk. For each CIM data model used by Patronus (Authentication, Network_Traffic, Web, Endpoint, Intrusion_Detection), click Edit → Edit Acceleration and enable with a summary range of at least 7 days.
2. Optimize Lookup Tables
If your asset or identity lookups exceed 100k rows:
- Ensure the lookup definition has
max_matches=1where appropriate. - Consider splitting large lookups into smaller, scoped tables.
- Use
inputlookupwithwhereclauses instead of loading entire tables.
3. Check Search Concurrency
Navigate to Settings → Server Settings → Search Preferences and verify that the max concurrent searches per user is at least 10. On the Performance page in Patronus, check for search queuing patterns.
4. Review the Performance Page
Use Configuration → Performance in Patronus to identify which searches are slow and whether data model acceleration is current.