Dashboards & Visualizations

PaloAlto Networks App- Dashboards partially show no data- improper node cfg in the app(?)

splt35t
New Member

Hi guys,

I have a a problem with the Splunk app for PaloAlto and have confirmed everything is properly set up, the syslog messages arrive at Splunk and I can search for them. Nevertheless some dashboards like global protect or user behavior are completely empty even though the data is there and is properly assigned. As example I have attached global protect, the following log entry can be found using search:

2019/01/22
13:18:35,12345678,SYSTEM,globalprotect,0,2019/01/22
13:18:35,,globalprotectgateway-logout-succ,GP-Gateway-N,0,0,general,informational,"GlobalProtect
gateway user logout succeeded. User
name: -, Client OS version: -, Reason:
user session
expired.",70946,0x0,0,0,0,0,,PA220
host = x.x.x.x log_subtype = globalprotect source = udp:514 sourcetype = pan:system

I have taken a look at the Palo Dashboards and it seems the query is looking at wrong nodes which do not exist (anymore) or the dataset variables must have changed at some point. In this case global protect_log cannot be found anywhere.

alt text

alt text

Am I missing something here or do we need an update? This could also be the explanation for the other dashboard not showing data, even tough all the data is there, pan:config - pan:data - pan:threat - pan:system - pan:traffic

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...