Get an error clicking on any of the pie-charts on the Threats Dashboard

[jeeames]

I get this error "Error in 'TsidxStats': Could not find datamodel: pan_logs"

We are running Splunk Enterprise 6.2 and Splunk for Palo Alto 4.2

[btorresgil]

This issue is fixed in v4.2.1 of the app. Thanks for bringing up this issue!

[jeeames]

That fixed it for me:

- Edit the "Threat Details" dashboard`s XML (Edit -> Edit Source)
- Locate datamodel="pan_logs" and change it to: datamodel="pan_firewall"

[bravon]

Does it still work if you type in a user or an ip?

[bravon]

Same problem here. Every other dashboard seems to be working, except the "Threat Details" Dashboard (Which is where you end up when you click a pie-chart in "Threat Dashboard"
Data Models for the Palo Alto app, there are only 3: pan_firewall, pan_wildfire_report and pan_endpoint

Solution:
- Edit the "Threat Details" dashboard`s XML (Edit -> Edit Source)
- Locate datamodel="pan_logs" and change it to: datamodel="pan_firewall"
Edit: See my comment below.

[bravon]

Hmm, this makes the dashboard work only when I don't specify user, so something is still not working