Palo Alto Dashboards: Only parsing last 7 days

[matthewfry]

When I attempt to view any data via the Palo Alto addon, it only pulls data from the last 7 days. If i set the date range back further than 7 days, I get no data. However, I have confirmed that this data does exist in the Splunk database.

I cannot find anywhere to configure how far back the addon will look at data.

Any ideas?

[panguy · Accepted solution]

The Data model Summary range is default to 7 days. The dashboards in our app will only show the last 7 days of events. This can be changed by adjusting the Summary Range in Settings > Data models > Edit Acceleration. Look for the Palo Alto Network Data models and adjust the Summary Range.

[matthewfry]

Thank you much! This is exactly what I was looking for!