Why are graphs slow after upgrading Splunk for Palo Alto Networks to 4.2?

[sysops_mls]

Last week we upgraded Splunk from 6.1 to 6.2 and the Palo Alto app ran fine. We then upgraded the Palo Alto app from 4.1 to 4.2. Ever since the 4.2 upgrade, the graphs run 30 - 60 minutes behind. Searches are fine and I can see the data coming into Splunk almost real-time in the app.

[btorresgil · Accepted solution]

Most likely your datamodel acceleration is trying to rebuild after all the upgrades. Check the Palo Alto Networks data models to see if the acceleration is 100% built. If it isn't, verify that the percentage is increasing. You can speed up the process of datamodel rebuild by reducing the amount of data that is accelerated in the datamodel acceleration settings. The default is 1 year of data, but you can reduce it.

[sysops_mls]

It must have been the acceleration, it was at 55% last week. Came in this morning and all is well.

[btorresgil]

Wonderful, I'm glad it's working now! Can you go ahead and mark my answer as correct? Thanks!