All Apps and Add-ons

Why is the Threat Dashboard blank after upgrading the Palo Alto Networks App for Splunk from 3.x to 5.0.1?

itreghenssler
Explorer

Using Splunk 6.2
Upgraded the Palo Alto Networks App for Splunk from 3.x (no TA installed) to 5.0.1 and after waiting for the data models to update to 100%, all of the Content dashboards are populating, but nothing under Threat - all of the dashboard objects show the grey warning triangle and 'tstats' Additionally, within the overview dashboard, the EventTypes panel is blank (no warning, but no data) and the Applications by Destination IP Location shows nothing, where prior it did show locations.

Prior to the upgrade all were working without issue for over a year.

I followed the steps in the upgrade guide and under troubleshooting. Created the inputs.conf file in the correct location for the PA App, deleted the lookups folder from the SplunkforPaloAltoNetworks folder (all default), verified that the data is flowing (as indicated by the Content dashboard and I can view/search the log data).

What did I miss?

0 Karma

itreghenssler
Explorer

I found the issue with the Threat Dashboard:
This was the default search string in the panels:

| `tstats' count FROM...

changing that to:

| `pan_tstats' count FROM...

There are several other panels where the sourcetype or field names needed to be changed. For example dst_ip is now dest_ip.

Resolved the issue with the panels in that view.

I still have not figured out the fix for Threat Details panels. If anyone knows the proper syntax for those, any help appreciated.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...