We are able to see data coming into the Splunk instance by checking index="pan_logs" , but there is nothing showing in the Palo Alto Networks App for Splunk. I tried to edit the panel and here is one of the sample search, which is not getting any data: `pan_logs` | fillnull value="" | stats count by host sourcetype log_subtype action category | stats dc(host) However, I am getting data using this search: `pan_logs` | fillnull value="" | stats count by host sourcetype | stats dc(host) I didn't see log_subtype, action, and category from the All Fields, and I assume that is the problem. Does anyone know why it is not working? ... View more

I am pretty new to Splunk. Guess what, the consultant has left and I was supposed to take care of Splunk. I got an alert saying "indexer is not reachable". I can ssh to the server, the CPU and disk are OK. What else can I check? ... View more