All Apps and Add-ons

Splunk for Palo Alto Networks 4.2.2 and Splunk 6.3.0 : I am receiving and can search logs, but why is the dashboard not populating?

New Member


Splunk for Palo Alto Networks 4.2.2 and Splunk 6.3.0, dashboard not populating. I'm receiving logs and can search on them, but dashboards are empty.


0 Karma


I'd guess:

The app assumes your data is in a "searched by default" index, and maybe it isn't any more.
The app uses an 'index=blah' or a macro that loads a line like that and the index it points to is wrong.
The app uses tags, events or both, and those are no longer being applied correctly.

I know of no magic bullet at this time, you just have to start digging into the searches to see what they are running, then start digging and fiddling to find out why they aren't running.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...