Hello. I've had some correspondence with your team but have not found a solution yet for my problem. Was wondering if we could try again.
Basically, my Splunk instance with this add-on is seeing all the PAN traffic coming in. Everything seems to be set up properly. I've got the data models accelerated and they appear to be normal:
Palo Alto Networks Firewall Logs
This data model represents all the syslogs produced by Palo Alto Networks Next-generation Firewalls and Panorama. The data model is structured such that all logs are part of the first root event object so the entire data model is accelerated.
17 Events Edit
Shared in App. Owned by nobody. Edit
Rebuild Update Edit
110. Last Access: 4/17/17 11:21:47.000 AM
Size on Disk
4/17/17 11:32:10.000 AM
I've rebuilt the data models, per prior instruction.
I'm at a point where one by one, all the dashboards just stop working. They worked perfectly when I first installed the add-on. I'm at a loss here. Could someone please help me? Splunk support will not help me with this and yes, I have the Enterprise version.
Thank you in advance.
when opening one of the panels in search (click magnifying glass icon on bottom of panel) does the search returns results? do you receive an error?
Hello Adonio. Thank you very much for your prompt response!
Let's take the Traffic Dashboard, for example. The first panel is "Bytes over time". In that panel it says "Search is waiting for input". When I click on the magnifying glass, nothing happens. When I click on the little "i" it says "Unknown SID".
try clicking the search tab all the way to the right on the blue navigation bar and then run a simple search like:
index = * sourcetype=pan:* | stats count by sourcetype index
do you see results? are the sourcetypes match the one in the docs? e.g. pan:threat, pan:config etc.
yes, looks good,
first hunch is that the user does not have index=main (default) set to search by default
try to fix that, go to settings -> access controls -> users -> your user -> scroll all the way to the bottom -> add default / main to indexes searched by default
where is my mind, sorry about that,
go to settings -> access controls -> roles -> your user role -> scroll all the way to the bottom -> add default / main to indexes searched by default