All Apps and Add-ons

Palo Alto Networks App for Splunk: Why are tstats reports for Traffic not displaying and it seems summary indexing is failing?

LintuMathews
Explorer

tstats reports for Traffic doesn't display and it seems summary indexing is not generating data. Can you please suggest a way to troubleshoot?

0 Karma
1 Solution

the_wolverine
Champion

The Overview is using real-time searches so you should be seeing data as long as data as flowing into Splunk.
https://answers.splunk.com/answers/215077/any-performance-issues-with-all-the-real-time-sear.html

Everything else is based on data model acceleration.

We have seen tstats delayed significantly. This may or may not be based on your volume of PAN data. You might want to ping PAN about tuning although we have given up and worked around it using summary indexing although Palo Alto will tell you that the latest version of the app is better tuned for data model acceleration -- it was many months of frustration.

https://answers.splunk.com/answers/326382/palo-alto-networks-app-for-splunk-data-model-frequ.html
https://answers.splunk.com/answers/318950/can-you-disable-the-acceleration-of-all-data-model.html

View solution in original post

0 Karma

the_wolverine
Champion

The Overview is using real-time searches so you should be seeing data as long as data as flowing into Splunk.
https://answers.splunk.com/answers/215077/any-performance-issues-with-all-the-real-time-sear.html

Everything else is based on data model acceleration.

We have seen tstats delayed significantly. This may or may not be based on your volume of PAN data. You might want to ping PAN about tuning although we have given up and worked around it using summary indexing although Palo Alto will tell you that the latest version of the app is better tuned for data model acceleration -- it was many months of frustration.

https://answers.splunk.com/answers/326382/palo-alto-networks-app-for-splunk-data-model-frequ.html
https://answers.splunk.com/answers/318950/can-you-disable-the-acceleration-of-all-data-model.html

0 Karma

LintuMathews
Explorer

We are seeing data coming real time and in the Palo Alto Overview Dashboard

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...