Splunk App for ACI - Polling causing significant load on APIC Controllers

[dxmiller]

We have been having an issue with the Splunk app for ACI consuming significant resources on our APIC controllers while it's polling. Is there a place within the app or add-on where we can change the polling interval?

[neha10]

Sure. You can decrease the polling interval in Add-on.

You can copy $SPLUNK_HOME/etc/apps/TA_cisco_ACI/default/inputs.conf to $SPLUNK_HOME/etc/apps/TA_cisco_ACI/local/inputs.conf and change the polling interval to the desirable frequency. Here is an example of stanza:

[script://./bin/collect.py -health fvTenant fvAp fvEPg fabricHealthTotal fabricNode eqptFabP eqptLeafP eqptCh eqptLC eqptFt eqptPsu eqptSupC ethpmPhysIf]
index = apic
sourcetype = cisco:apic:health
disabled = 1
interval = 120 <<<<<<<<<<<<<<<<<<<<<<<< This can be changed.
passAuth = admin