Hi all,
Seem to not be getting much except Network Incidents Per Hour with new Splunk 7 install and New Palo Alto Networks App and Add-on.
When I click on 'Open in Search' I get 'undefined' in the search window. Any ideas what I may be missing? Everything installed stock. Firewalls sysloging directly to Spunk UDP 520, see different logs for traffic, threat, system on the search page.
Thanks for any ideas folks may have,
Hello, which panels are not populating that you expect to populate? If you're only sending Firewall/Panorama logs with types of traffic, threat, and system, then in the new 'All Incidents' dashboard you would only see "Network Incidents Per Hour". The other 'per hour' trend graphs are populated by other products or logs and you'll need these to see these incidents.
For more information, click the tooltip next to the dashboard's title, then click 'More...' Or see the dashboard's documentation here:
https://splunk.paloaltonetworks.com/dashboards.html#incidents
Hello, which panels are not populating that you expect to populate? If you're only sending Firewall/Panorama logs with types of traffic, threat, and system, then in the new 'All Incidents' dashboard you would only see "Network Incidents Per Hour". The other 'per hour' trend graphs are populated by other products or logs and you'll need these to see these incidents.
For more information, click the tooltip next to the dashboard's title, then click 'More...' Or see the dashboard's documentation here:
https://splunk.paloaltonetworks.com/dashboards.html#incidents
Thanks for the insight on the dashboards. Much appreciated.