Incorrect use of Network_Sessions CIM model

[automine]

Per http://docs.splunk.com/Documentation/CIM/4.7.0/User/NetworkSessions the Network_Sessions DM is for DHCP and VPN traffic. The current version includes these eventtypes:

[pan_traffic_start]
search = sourcetype=pan_traffic OR sourcetype=pan:traffic AND log_subtype="start"
#tags = network session start
[pan_traffic_end]
search = sourcetype=pan_traffic OR sourcetype=pan:traffic AND log_subtype="end"

This tags ALL palo traffic as Network Sessions, which makes the data model run for a very long time.

[btorresgil]

Thanks for the feedback, we'll check w/ Splunk on this make correction as necessary. Will report the results here.

[MonkeyKa]

I worked around this by not logging start events as recommended by PaloAlto