All Apps and Add-ons

Palo Alto Networks App for Splunk: Why is the "Threat Subtypes" panel on the "Threat dashboard" showing incomplete data?


On the "Threat Dashboard", under "Threat Subtypes" chart panel, I clicked on the subsearch and below is the search returned:

| `tstats` count FROM `node(log.threat)`    `groupby(_time log.log_subtype)` | timechart values(count) by log_subtype

But this panel/subsearch shows incomplete information. When searching for past 7 days from 11/17, the data is returned for date beyond 11/12. There is no data for date between 11/13 and 11/17. It is really not possible. When I check raw events under sourcetype=pan_threat, I see continuous streaming of data.

Why is data not showing in the panel/dashboard, BUT showing in the raw events?

0 Karma


I can't think of anything in the app itself that would cause this problem. The dashboard leverages the datamodel acceleration features of Splunk 6, so if the datamodel acceleration is not up-to-date, you could find data missing for some time periods. But I find it strange that you see data for time periods you aren't even requesting. One suggestions is to re-install the app, since a customization in the props or transforms might cause the logs needed to populate this panel to be misinterpreted. Another suggestions is to ensure your time and timezones match on all firewalls and Splunk nodes and that the timestamp on the logs is being interpreted correctly by Splunk.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...