I get this error "Error in 'TsidxStats': Could not find datamodel: pan_logs"
We are running Splunk Enterprise 6.2 and Splunk for Palo Alto 4.2
This issue is fixed in v4.2.1 of the app. Thanks for bringing up this issue!
That fixed it for me:
- Edit the "Threat Details" dashboard`s XML (Edit -> Edit Source)
- Locate datamodel="pan_logs" and change it to: datamodel="pan_firewall"
Does it still work if you type in a user or an ip?
Same problem here. Every other dashboard seems to be working, except the "Threat Details" Dashboard (Which is where you end up when you click a pie-chart in "Threat Dashboard"
Data Models for the Palo Alto app, there are only 3: pan_firewall, pan_wildfire_report and pan_endpoint
Solution:
- Edit the "Threat Details" dashboard`s XML (Edit -> Edit Source)
- Locate datamodel="pan_logs" and change it to: datamodel="pan_firewall"
Edit: See my comment below.
Hmm, this makes the dashboard work only when I don't specify user, so something is still not working