i over looked that one, as there doesn't seems to be a build status displayed. This is what I see in the Datamodel overview: *=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Palo Alto Networks Aperture Logs MODEL Datasets 6 Events Edit Permissions Shared in App. Owned by nobody. Edit ACCELERATION Model is not accelerated. =-=-=-=-=-=-=-=- In Operation-Data Model Audit the following error is shown: "Error in 'DataModelEvaluator': Data model 'pan_endpoint' was not found. " and the acceleration on the data models " disabled" in red. In the Event types there is a "pan_endpoint" definition. We are currently using the free Splunk Entrprise (no licensing alerts or violations) and it seems there is no "Edit-Edit Acceleration" in the data model management page. Is it an option to disable-remove the PA app and reinstall? ... View more