Logs are flowing into Splunk -- The Realtime Event Feed has data and logs are broken out into sourcetypes pan:traffic, pan:system, and pan:config.
I can click on Activity-->User Behavior and it sees Traffic Events and SaaS events for the past sixty minutes. URL and Data Events are zero.
At the bottom of the dashboard there are entries for "Applications Not Using Default Port" and "Rare Applications".
Nothing else on the dashboard has dat -- Top Hostnames, Top Web Categories, and Top Applications are all blank.
The dashboard "Web Activity" is also completely blank.
On the flip side, the SaaS Activity dashboard appears to be working normally.
I just can't figure out why there is no data in User Behavior or Web Activity.
