All Apps and Add-ons

Why is the Palo Alto app configuration page showing "Page not found"?

tecooper
Explorer

The Palo Alto app was previously working, all dashboards displayed data. Now it's not working. I'm working through the troubleshooting steps here https://splunk.paloaltonetworks.com/troubleshoot.html and pretty sure it's a parsing issue. I'm working with the Networking team (who set up the PA) to check the syslog settings. But in the meantime, when I go to the Configuration page, I get Buttercup and page not found. I'm assuming this is a separate issue, and I have no idea what to do. Can anyone help me?

We have only 1 Splunk server, running 7.2.4.2. It's on prem. Both the Palo Alto app (6.1.1) and TA (6.1.1) are installed.

tecooper
Explorer

Most of the app is fixed. All of the dashboards work. I had to go to Settings/Data Models and enable acceleration for the 4 SplunkforPaloAltoNetworks data models (Step 4. Check acceleration and summary indexing). And then I had to update it because the date was showing 12/31/69. Once I did that, the dashboards started populating.

Under Step 3. Verify logs are parsed correctly in the above link, it says to do a search for eventtype=pan_config. I was stuck there because I wasn't getting any results. I finally changed it to pan* and got results. There aren't any pan_config eventtypes.

0 Karma

raja8220
New Member

I have done the steps but still not working getting page not found in dashboard object.

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...