Palo Alto Wildfire dashboard is not working

[pateriaak]

I've recently started ingestion of wildfire events in Palo Alto app. Dashboard "Wildfire Submission" seems broken. I looked into the query forming those panels. One of the query I would like to mention here -
| tstats summariesonly=t count FROM datamodel="pan_firewall" WHERE nodename="log.wildfire" """" groupby _time log.rule log.src_ip log.dest_ip log.verdict log.file_name log.file_type log.user log.app log.file_hash log.src_location

Field "file_name" is breaking this query result which is coming from nodename=log.wildfire which in-turn populating from data model pan_firewall. Removing this field will show result count and remaining fields.
Upon looking into the datamodel I see this field as optional and atleast 50% raw events contain field file_name from this sourcetype.
Any lead would be helpful.

[lakshman239 · Accepted solution]

As this is an optional field, you can remove that from the search, if that would suffice to show results in the dashboard. the other option would be to force 'unknown' for file_name if its null, using local/props.conf. something like

EVAL-file_name=coalesce(file_name,"unknown")

where file_name is the extraction from the actual app/add-on.

[pateriaak]

yes, Like I mentioned removing this field displays results. So I can definitely remove this field. thank you for your input.