I placed Splunk_TA_stream on a bunch of boxes and now the search head it's hitting is getting murdered performance-wise. I really only need the Splunk_TA_stream to check in every few hours at most. But it seems almost real time. Is there a configuration option for this? I'd really like to be in a place where I can get 3k universal forwarders checking in to 3 Reference search heads in a search head cluster without a performance impact.