All Apps and Add-ons

Palo Alto Networks App for Splunk: Why are tstats reports for Traffic not displaying and it seems summary indexing is failing?

Explorer

tstats reports for Traffic doesn't display and it seems summary indexing is not generating data. Can you please suggest a way to troubleshoot?

0 Karma
1 Solution

Champion

The Overview is using real-time searches so you should be seeing data as long as data as flowing into Splunk.
https://answers.splunk.com/answers/215077/any-performance-issues-with-all-the-real-time-sear.html

Everything else is based on data model acceleration.

We have seen tstats delayed significantly. This may or may not be based on your volume of PAN data. You might want to ping PAN about tuning although we have given up and worked around it using summary indexing although Palo Alto will tell you that the latest version of the app is better tuned for data model acceleration -- it was many months of frustration.

https://answers.splunk.com/answers/326382/palo-alto-networks-app-for-splunk-data-model-frequ.html
https://answers.splunk.com/answers/318950/can-you-disable-the-acceleration-of-all-data-model.html

View solution in original post

0 Karma

Champion

The Overview is using real-time searches so you should be seeing data as long as data as flowing into Splunk.
https://answers.splunk.com/answers/215077/any-performance-issues-with-all-the-real-time-sear.html

Everything else is based on data model acceleration.

We have seen tstats delayed significantly. This may or may not be based on your volume of PAN data. You might want to ping PAN about tuning although we have given up and worked around it using summary indexing although Palo Alto will tell you that the latest version of the app is better tuned for data model acceleration -- it was many months of frustration.

https://answers.splunk.com/answers/326382/palo-alto-networks-app-for-splunk-data-model-frequ.html
https://answers.splunk.com/answers/318950/can-you-disable-the-acceleration-of-all-data-model.html

View solution in original post

0 Karma

Explorer

We are seeing data coming real time and in the Palo Alto Overview Dashboard

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!