All Apps and Add-ons

Total Endpoints Reporting in Palo Alto Networks App is always 0


This is specifically about Palo Alto Traps (or as it's now called Cortex XDR Prevent) logs inside Splunk.  I am having a specific issue with elements of the Palo Alto Networks App dashboards showing no data.

I have Cortex XDR (Palo Alto's Cloud version of Traps EMS) sending data via TCP SSL to Splunk to a dedicated index and I see events.

In the dashboard "Endpoint Operations", "Total Endpoints Reporting" is always 0, even though other elements of that same dashboard are showing data correctly.  

When I look at the search "| tstats summariesonly=t values(log.content_version) AS log.content_version, values(log.type) AS log.type, values(log.severity) AS log.severity, values(log.dest_name) AS log.dest_name, values(log.src_host) AS log.src_host count FROM datamodel="pan_traps" WHERE nodename="log.operations" """" log.severity="*" GROUPBY _time log.log_subtype log.user | rename log.* AS * | dedup dest_name | stats dc(dest_name)" 

Everything is great until the last dedup/dc part.  "dest_name" is always null for all of my values for some reason.  So this suggests that the data that Cortex XDR sends into Splunk does not have what the add-on expects.

I'm curious if anyone has any experience with this and can advise a workaround or solution.

Labels (4)
0 Karma


Hi @ranade , I'm afraid I don't have a reply for this one yet, but I'd like to get back to you once we implement it!

May I inquire if you have a link to documentation for your solution to send "Cortex XDR sending data via TCP SSL to Splunk"? Is that just a standard TCP-Input on Splunk side?

My Security team is indicating that Cortex-XDR is only capable of API.


0 Karma
Get Updates on the Splunk Community!

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...

Observability Cloud | AWS PrivateLink Enabled for Splunk Observability Cloud

We’ve enabled AWS PrivateLink for Observability Cloud, giving you an additional inbound connection to send ...

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...