Cisco ACI APP for Splunk, when I enable this collection, it creates a huge load on the APIC.
[script://$SPLUNK_HOME/etc/apps/TA_cisco-ACI/bin/collect.py -classInfo aaaModLR faultRecord eventRecord]
I have attempted to widen the interval, but it just reduces the number of times the load happens. The APIC is almost unusable while this collection is happening. I removed these one at a time, and it appears to be the poll of the eventRecord that is causing the drag on the APIC. I thought Splunk would only pull in the new information since the last poll, but that does not appear to be what is actually happening. Is this expected? Is there a way to remedy this issue?
