I did notice 2 things, first off my inputs.conf monitor stanza had the sourcetype of pan:logs and not pan:log, I corrected that on the deployment server and re-deployed.
Secondly, as admin user I did not have a default index set. Once I set it to pan_logs the dashboards began to populate a few entries. Still figuring out what is missing, but data in the dashboard is a start.
I have syslog-ng set to not enter a time stamp before the logs and my monitor stanza looks like this:
#Palo Alto Devices
[monitor:///var/log/data/palo/.../*]
disabled = 0
host_segment = 6
sourcetype = pan:log
ignoreOlderThan = 1d
index = pan_logs
blacklist = .gz$
index=pan* shows results for pan_logs as the index.
sourcetype=pan* revealed pan:log
... View more