Hi,
We have been running PaloAlto Netowork for splunk for 6 months so far.
From time adjustment, I can only go back and see certain time which is less than a month.
When I look at actual logs, I see the past log still there. but it is not show up in the Global Protect dashboard.
What am I missing?
Thank you,
The dashboard’s are built on accelerated data models. By default they are set to 7 days. You can increase the data acceleration from the data model UI. Documentation on this is available here.
https://docs.splunk.com/Documentation/Splunk/7.3.0/Knowledge/Managedatamodels
I found the setting in datamodel.conf.
Thank you so much for your help!!
Thank you panguy for the answer!
I was able to find the data set and disabled acceleration to edit it.
But, I am having hard time finding where the range setting is.....
Thank you,