All Apps and Add-ons

Palo Alto Dashboards: Only parsing last 7 days

matthewfry
Explorer

When I attempt to view any data via the Palo Alto addon, it only pulls data from the last 7 days. If i set the date range back further than 7 days, I get no data. However, I have confirmed that this data does exist in the Splunk database.

I cannot find anywhere to configure how far back the addon will look at data.

Any ideas?

0 Karma
1 Solution

panguy
Contributor

The Data model Summary range is default to 7 days. The dashboards in our app will only show the last 7 days of events. This can be changed by adjusting the Summary Range in Settings > Data models > Edit Acceleration. Look for the Palo Alto Network Data models and adjust the Summary Range.

View solution in original post

panguy
Contributor

The Data model Summary range is default to 7 days. The dashboards in our app will only show the last 7 days of events. This can be changed by adjusting the Summary Range in Settings > Data models > Edit Acceleration. Look for the Palo Alto Network Data models and adjust the Summary Range.

View solution in original post

matthewfry
Explorer

Thank you much! This is exactly what I was looking for!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.