All Apps and Add-ons

Why is the Palo Alto app configuration page showing "Page not found"?

tecooper
Explorer

The Palo Alto app was previously working, all dashboards displayed data. Now it's not working. I'm working through the troubleshooting steps here https://splunk.paloaltonetworks.com/troubleshoot.html and pretty sure it's a parsing issue. I'm working with the Networking team (who set up the PA) to check the syslog settings. But in the meantime, when I go to the Configuration page, I get Buttercup and page not found. I'm assuming this is a separate issue, and I have no idea what to do. Can anyone help me?

We have only 1 Splunk server, running 7.2.4.2. It's on prem. Both the Palo Alto app (6.1.1) and TA (6.1.1) are installed.

tecooper
Explorer

Most of the app is fixed. All of the dashboards work. I had to go to Settings/Data Models and enable acceleration for the 4 SplunkforPaloAltoNetworks data models (Step 4. Check acceleration and summary indexing). And then I had to update it because the date was showing 12/31/69. Once I did that, the dashboards started populating.

Under Step 3. Verify logs are parsed correctly in the above link, it says to do a search for eventtype=pan_config. I was stuck there because I wasn't getting any results. I finally changed it to pan* and got results. There aren't any pan_config eventtypes.

0 Karma

raja8220
New Member

I have done the steps but still not working getting page not found in dashboard object.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...