All Apps and Add-ons

Problem with user roles in Palo Alto app

New Member

Problem with user roles in Palo Alto app
I have two different roles, both inherited with user privilegies. Roles are: All_logs and Network_logs
Only difference between those roles are that All_logs have Restrict search terms: * and
Network_logs Restrict search terms: index=pan_logs

And the problem is with Palo Alto Networks app, users who belongs to All_logs role, everything is working fine, but users with Network_logs don't see anything with app, but search "index=pan_logs" works fine.
Why app doesn't show information? For example Threat Dashboard gives "Search produced no results" information under dropdown menus, and all panels give "No results found"

0 Karma

Builder

This is more of a question about Splunk than about the App, but I can offer a few suggestions on things to check.

  1. Verify the logs are actually in the pan_logs index. This is not the default if using the new Palo Alto Networks Add-on

  2. Check that the Network_logs role can see the pan_logs index (or the 'All non-internal indexes' settings), and the pan_logs index is in 'Indexes searched by default'.

  3. Instead of using 'Restrict search terms', you can set the role to only see the 'pan_logs' index, which would have the same effect.

Since this is not an App-specific issue, but an issue with Splunk role settings and an index, you can also troubleshoot this with Splunk support by opening a ticket.

0 Karma

New Member

Thanks for answer!

Some comments:
1. Yes, logs are actually in the pan_logs index
2. Network_logs can see pan_logs index, search index=pan_logs works fine with this role.
3. I made some changes to roles -> no Restrict search term and available index: pan_logs, and now app works, but this is not the solution I want to use. We have other issues, so we need the use 'Restrict search terms'

Splunk Support answered to me that this is app related question.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!