All Apps and Add-ons

Why is the Threat Dashboard blank after upgrading the Palo Alto Networks App for Splunk from 3.x to 5.0.1?

itreghenssler
Explorer

Using Splunk 6.2
Upgraded the Palo Alto Networks App for Splunk from 3.x (no TA installed) to 5.0.1 and after waiting for the data models to update to 100%, all of the Content dashboards are populating, but nothing under Threat - all of the dashboard objects show the grey warning triangle and 'tstats' Additionally, within the overview dashboard, the EventTypes panel is blank (no warning, but no data) and the Applications by Destination IP Location shows nothing, where prior it did show locations.

Prior to the upgrade all were working without issue for over a year.

I followed the steps in the upgrade guide and under troubleshooting. Created the inputs.conf file in the correct location for the PA App, deleted the lookups folder from the SplunkforPaloAltoNetworks folder (all default), verified that the data is flowing (as indicated by the Content dashboard and I can view/search the log data).

What did I miss?

0 Karma

itreghenssler
Explorer

I found the issue with the Threat Dashboard:
This was the default search string in the panels:

| `tstats' count FROM...

changing that to:

| `pan_tstats' count FROM...

There are several other panels where the sourcetype or field names needed to be changed. For example dst_ip is now dest_ip.

Resolved the issue with the panels in that view.

I still have not figured out the fix for Threat Details panels. If anyone knows the proper syntax for those, any help appreciated.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...