Hello. There are actually only 4 real time searches in the entire app. All of them are on the Overview Dashboard. The app uses search templates and search post process to reduce load from real-time searches, and uses datamodel acceleration in non-realtime pivots for the rest of the dashboards.
If you're experiencing performance issues, can you describe what symptoms you're seeing and how many logs per second you're sending to splunk? Is the performance problem exclusive to the Palo Alto Networks app, or across all apps? Just one dashboard, or all dashboards?