Real Time Event Data not showing up. Install used a seperate index for paloalto.

[Iwdavies]

PaloAlto Networks app dashboard issue. All dashboards work with the exception of the Realtime Event Feed. When I created my input for paloalo I used udp 514 and a new index for the data (pan_logs). I played with the search string in the various dashboards and found that if I put index=pan_logs at the beginning of the string that it will start pulling the feeds correctly. However, I don't know how to change the string for the dashboards so that they work...

some things to note:

I have already added the no_appending_timestamp = true to the inputs file
time is the same on the splunk server as it is with the palo alto equipment.
I have not added any time zone information in the props.conf file since the time stamps are the same.

Ian

[Iwdavies · Accepted solution]

I found the solution to this issue:

I went to the location of the view (D:\Program Files\Splunk\etc\apps\SplunkforPaloAltoNetworks\default\data\ui\views\realtime_event_feed.xml) and added "index=pan_logs" to the first query string. Saved the file and restarted splunk. Now the Real Event Feed is working fine.

[btorresgil]

You shouldn't need to add the index to the search. Are you sure you are searching the pan_logs index by default in your user/role settings?

[Iwdavies]

That worked as well, so I undid my change and added the pan_logs to the indexes that are searched by default.

[btorresgil]

ok, great to hear, glad it's working.