Dashboards & Visualizations

Palo Alto Wildfire dashboard is not working

pateriaak
Explorer

I've recently started ingestion of wildfire events in Palo Alto app. Dashboard "Wildfire Submission" seems broken. I looked into the query forming those panels. One of the query I would like to mention here -
| tstats summariesonly=t count FROM datamodel="pan_firewall" WHERE nodename="log.wildfire" """" groupby _time log.rule log.src_ip log.dest_ip log.verdict log.file_name log.file_type log.user log.app log.file_hash log.src_location

Field "file_name" is breaking this query result which is coming from nodename=log.wildfire which in-turn populating from data model pan_firewall. Removing this field will show result count and remaining fields.
Upon looking into the datamodel I see this field as optional and atleast 50% raw events contain field file_name from this sourcetype.
Any lead would be helpful.

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

As this is an optional field, you can remove that from the search, if that would suffice to show results in the dashboard. the other option would be to force 'unknown' for file_name if its null, using local/props.conf. something like

EVAL-file_name=coalesce(file_name,"unknown")

where file_name is the extraction from the actual app/add-on.

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

As this is an optional field, you can remove that from the search, if that would suffice to show results in the dashboard. the other option would be to force 'unknown' for file_name if its null, using local/props.conf. something like

EVAL-file_name=coalesce(file_name,"unknown")

where file_name is the extraction from the actual app/add-on.

View solution in original post

0 Karma

pateriaak
Explorer

yes, Like I mentioned removing this field displays results. So I can definitely remove this field. thank you for your input.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!