Dashboards & Visualizations

Palo Alto Wildfire dashboard is not working

pateriaak
Explorer

I've recently started ingestion of wildfire events in Palo Alto app. Dashboard "Wildfire Submission" seems broken. I looked into the query forming those panels. One of the query I would like to mention here -
| tstats summariesonly=t count FROM datamodel="pan_firewall" WHERE nodename="log.wildfire" """" groupby _time log.rule log.src_ip log.dest_ip log.verdict log.file_name log.file_type log.user log.app log.file_hash log.src_location

Field "file_name" is breaking this query result which is coming from nodename=log.wildfire which in-turn populating from data model pan_firewall. Removing this field will show result count and remaining fields.
Upon looking into the datamodel I see this field as optional and atleast 50% raw events contain field file_name from this sourcetype.
Any lead would be helpful.

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

As this is an optional field, you can remove that from the search, if that would suffice to show results in the dashboard. the other option would be to force 'unknown' for file_name if its null, using local/props.conf. something like

EVAL-file_name=coalesce(file_name,"unknown")

where file_name is the extraction from the actual app/add-on.

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

As this is an optional field, you can remove that from the search, if that would suffice to show results in the dashboard. the other option would be to force 'unknown' for file_name if its null, using local/props.conf. something like

EVAL-file_name=coalesce(file_name,"unknown")

where file_name is the extraction from the actual app/add-on.

0 Karma

pateriaak
Explorer

yes, Like I mentioned removing this field displays results. So I can definitely remove this field. thank you for your input.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...