Why does the Palo Alto Networks App for Splunk show no data, but searching index="pan_logs" produces results?

[charlesguo_2]

We are able to see data coming into the Splunk instance by checking index="pan_logs", but there is nothing showing in the Palo Alto Networks App for Splunk.

I tried to edit the panel and here is one of the sample search, which is not getting any data:

`pan_logs` | fillnull value="" | stats count by host sourcetype log_subtype action category | stats dc(host)

However, I am getting data using this search:

`pan_logs` | fillnull value="" | stats count by host sourcetype | stats dc(host)

I didn't see log_subtype, action, and category from the All Fields, and I assume that is the problem. Does anyone know why it is not working?

[niemesrw · Accepted solution]

My guess is that the technology add-on hasn't been set up completely.

In particular, the no_appending_timestamp option is important in the inputs.conf - and it's different depending on whether you're using UDP or TCP to send logs to your indexer. In the case of TCP/SSL you don't need to have that stanza.

[charlesguo_2]

It turns out that our Palo Alto Addon is not installed properly (still don't know why).
We installed the Addon by hand and it works now.