Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: Why are graphs slow after upgrading Splunk for...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Last week we upgraded Splunk from 6.1 to 6.2 and the Palo Alto app ran fine. We then upgraded the Palo Alto app from 4.1 to 4.2. Ever since the 4.2 upgrade, the graphs run 30 - 60 minutes behind. Searches are fine and I can see the data coming into Splunk almost real-time in the app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Most likely your datamodel acceleration is trying to rebuild after all the upgrades. Check the Palo Alto Networks data models to see if the acceleration is 100% built. If it isn't, verify that the percentage is increasing. You can speed up the process of datamodel rebuild by reducing the amount of data that is accelerated in the datamodel acceleration settings. The default is 1 year of data, but you can reduce it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Most likely your datamodel acceleration is trying to rebuild after all the upgrades. Check the Palo Alto Networks data models to see if the acceleration is 100% built. If it isn't, verify that the percentage is increasing. You can speed up the process of datamodel rebuild by reducing the amount of data that is accelerated in the datamodel acceleration settings. The default is 1 year of data, but you can reduce it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It must have been the acceleration, it was at 55% last week. Came in this morning and all is well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wonderful, I'm glad it's working now! Can you go ahead and mark my answer as correct? Thanks!
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
