Hi Shawno:
The Palo Alto App and Add on are supported by Palo Alto and they're very happy to work with folks on getting the app to work. I recommend you use your power as a PA customer to reach out to them for more specific help.
If you'd like this community to help, you will need to be more specific, like telling us what dashboard and whether there is more info about the error (is there an actual context to the error or does it just say "error"). See if you can give a bit more info here and then people will be able to help out.
Also you have an error on a dashboard are also talking about data no longer ingesting.
Are you sure? Is the data there if you just say index=blah sourcetype=blah... ? Or is it that the error is stopping data from po
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
