All Apps and Add-ons

Palo Alto Networks App and Add-on for Splunk: Why have dashboards stopped working?

BrendanCO
Path Finder

Hello. I've had some correspondence with your team but have not found a solution yet for my problem. Was wondering if we could try again.
Basically, my Splunk instance with this add-on is seeing all the PAN traffic coming in. Everything seems to be set up properly. I've got the data models accelerated and they appear to be normal:
Palo Alto Networks Firewall Logs
This data model represents all the syslogs produced by Palo Alto Networks Next-generation Firewalls and Panorama. The data model is structured such that all logs are part of the first root event object so the entire data model is accelerated.
MODEL
Datasets
17 Events Edit
Permissions
Shared in App. Owned by nobody. Edit
ACCELERATION
Rebuild Update Edit
Status
100.00% Completed
Access Count
110. Last Access: 4/17/17 11:21:47.000 AM
Size on Disk
1046.07MB
Summary Range
2678400 second(s)
Buckets
49
Updated
4/17/17 11:32:10.000 AM

I've rebuilt the data models, per prior instruction.

I'm at a point where one by one, all the dashboards just stop working. They worked perfectly when I first installed the add-on. I'm at a loss here. Could someone please help me? Splunk support will not help me with this and yes, I have the Enterprise version.

Thank you in advance.

Brendan

0 Karma

BrendanCO
Path Finder

I have an update for those interested in this. I added an input in one of the dashboards. It didn't work. So, I went back in and deleted the input and saved. This broke the dashboard, permanently. I checked out the source code of the dash and couldn't find anything related to what I did, but it sure as sh*t didn't work again until I deleted the app and reinstalled.

0 Karma

adonio
Ultra Champion

did re-installing the app solved your problem?

0 Karma

BrendanCO
Path Finder

Yes it did

0 Karma

adonio
Ultra Champion

Hi BrendanCO,
when opening one of the panels in search (click magnifying glass icon on bottom of panel) does the search returns results? do you receive an error?

BrendanCO
Path Finder

Adonio - did this change to completed? I still don't have the dashboards working and everything is running from user splunk. I can confirm that I installed Splunk as the user splunk.

0 Karma

BrendanCO
Path Finder

Hello Adonio. Thank you very much for your prompt response!

Let's take the Traffic Dashboard, for example. The first panel is "Bytes over time". In that panel it says "Search is waiting for input". When I click on the magnifying glass, nothing happens. When I click on the little "i" it says "Unknown SID".

0 Karma

adonio
Ultra Champion

try clicking the search tab all the way to the right on the blue navigation bar and then run a simple search like: index = * sourcetype=pan:* | stats count by sourcetype index
do you see results? are the sourcetypes match the one in the docs? e.g. pan:threat, pan:config etc.

0 Karma

BrendanCO
Path Finder

I believe this looks correct. Would you agree?

alt text

0 Karma

BrendanCO
Path Finder

Here's the link if that didn't work;

http://imgur.com/UvdVPWS

0 Karma

adonio
Ultra Champion

yes, looks good,
first hunch is that the user does not have index=main (default) set to search by default
try to fix that, go to settings -> access controls -> users -> your user -> scroll all the way to the bottom -> add default / main to indexes searched by default

0 Karma

BrendanCO
Path Finder

I go under my user and at the bottom it has "Assign to roles", then "Set Password", then save. Nothing about indexes...
http://imgur.com/xofM7xP

0 Karma

adonio
Ultra Champion

where is my mind, sorry about that,
go to settings -> access controls -> roles -> your user role -> scroll all the way to the bottom -> add default / main to indexes searched by default

0 Karma

BrendanCO
Path Finder

No worries, Adonio! I'm just very very much appreciating the help.

That appears to be set correctly. Here's the screen shot:
http://imgur.com/0CuiEq1

0 Karma

adonio
Ultra Champion

add the "all non internal indexes" to the Selected Indexes (top one) and try again

0 Karma

BrendanCO
Path Finder

Still showing "Search is waiting for input". Nothing new populated.

0 Karma

adonio
Ultra Champion

very odd, try the search above without the index = * so:

sourcetype = pan:* | stats count by sourcetype

do you get results?

also, noticed your username, check the inheritance for role and verify this role searches by default all non internal indexes

0 Karma

BrendanCO
Path Finder

Nothing with that search.
http://imgur.com/hJ7L1m5

0 Karma

adonio
Ultra Champion

forgot the star there
sourcetype=pan:* | stats count by sourcetype

0 Karma

BrendanCO
Path Finder

This search is taking a long time. I set it for 30 days and it's still running, but here's what it is showing so far:
http://imgur.com/tUe6l9L

0 Karma

adonio
Ultra Champion

very interesting, the dashboard still not populated?
looks like you overcome the indexes permission issue. Can you run the same search from the PAN app? navigate to app for PAN -> click search on blue nav bar -> run the same search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...