After Installing Palo Alto App in Splunk performance is degraded

[raomu]

Hi,

We recently have deployed Palo Alto App in our environment and noticed performance is degraded.

I went to see all the searched running under Job -> activity

and see most of the jobs are executed under System-user and all are related to Palo Alto that too span of every 2 min.

Spunk Environment details :

Spunk Managed cloud service
24 Indexers
2 SH not in cluster mode

Any suggestion why so many jobs are running for Palo Alto ?

[micahkemp]

Can you include the details (name, search) of the jobs you noticed?

[raomu]

user name - Spunk-System-User
search1 says - WildFire Reports - Retrieve Report
search 2 says - Applications - Retrieve New Apps

like this there are many reports and query.

[raomu]

within 3 min this job has triggered twice

WildFire Reports - Retrieve Report