PCE labels Are Not Updated in the Security Operations Dashboard
Symptom: If there are new labels, or workloads are added to the PCE, the new labels and workloads will not be visible right away.
Cause: The default interval to sync workloads and labels from the PCE is set to a minimum of 60 minutes. This period is configurable through the data input. The newly added labels or workloads on the PCE should be available in the Splunk App after an interval of 60 minutes.
Fix: To force a resync of labels to the PCE, you can disable and enable the TA. This forces the TA to make API calls to the PCE. This operation should be used with caution because of the additional API calls to the PCE.