Splunk for Palo Alto Networks: Why we not seeing any pan_data_filtering to populate the "Data Filtering" dashboard?

[lbogle]

Hello Splunkers,

Thought I’d check with you on this. We are not seeing information in the ‘data filtering’ dashboard. URL filtering works fine.
We have no ‘data filtering’ security profile set up, but we are seeing data filtering data show up in the PAN firewall monitor dashboard for data filtering with files and executables. When I go to the PAN app, there is no data within pan_data_filtering.
I do, however see the data files and names etc in pan_file.
What am I missing to get the data filtering dash data visible?
Thanks!

[btorresgil · Accepted solution]

Hi lbogle, Data Filtering is different than File Blocking. Data filtering dashboard will only show data from pan_data_filtering, not data from pan_file.

[lbogle]

So if I don't have pan_data_filtering within Splunk, there will be no data filtering. What from my PAN box is supposed to generate the pan_data_filtering log data?
Thanks!

[lbogle]

Nevermind. I recieved your earlier comment regarding a data filtering profile. Thanks!