You can disable acceleration to save disk space. However, the dashboards that come with the app rely on the acceleration, so disabling acceleration will make the dashboards blank (except the Overview dashboard).
A few alternative options:
If you don't use the dashboards or datamodel and only want to parse the Palo Alto Networks data, you can move from the Palo Alto Networks App to the new Palo Alto Networks Add-on. The Add-on has all the parsing capability and works with Splunk Enterprise Security 4.0 and Common Information Model 4.x. But it doesn't have any dashboards or datamodel.
You can upgrade to Palo Alto Networks App version 5.0 which optimizes the datamodel for more efficient performance and disk utilization. This might help because it will use less disk space for the acceleration.
If you choose to upgrade to App version 5.0, please use the upgrade guide:
http://pansplunk.readthedocs.org/en/latest/upgrade.html
... View more