All Apps and Add-ons

Any performance issues with all the real-time searches in Palo Alto Networks app?

the_wolverine
Champion

I have just installed the app and want to know if anyone has encountered any performance issues with the multitude (nearly all) real-time searches that are used in the dashboard.

I will refactor the searches to not use real-time search.

0 Karma

btorresgil
Builder

Hello. There are actually only 4 real time searches in the entire app. All of them are on the Overview Dashboard. The app uses search templates and search post process to reduce load from real-time searches, and uses datamodel acceleration in non-realtime pivots for the rest of the dashboards.

If you're experiencing performance issues, can you describe what symptoms you're seeing and how many logs per second you're sending to splunk? Is the performance problem exclusive to the Palo Alto Networks app, or across all apps? Just one dashboard, or all dashboards?

Thanks,
-Brian

0 Karma

the_wolverine
Champion

We tightly control the use of real-time searches in our env because each rt-search consumes a core of resource. Privileged users might be allowed to run a single rt-search. We have since converted all the rt searches in overview to scheduled searches.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...