Thanks for your feedback. You are correct they are suppose to be per-populated. I have created an issue on Github: https://github.com/PaloAltoNetworks/Splunk_TA_paloalto/issues/13 We will work on getting this added in the next release. ... View more

EDIT: I updated Panorama to 8.0.6-h3 and rebooted, and the macro is working now. I expect the lookup should be populated on the next scheduled run. Thanks. Thanks - I figured that was related and had been working on resolving (I also posted https://answers.splunk.com/answers/606458/palo-alto-networks-add-on-for-splunk-601-app-list.html) I've got my app_list.csv populated now, but when I try to run the manual macro "| pancontentpack threats" I get the following error: External search command 'pancontentpack' returned error code 2. Script output = "ERROR show -> predefined is unexpected ". threat_list.csv is still empty but some of the dashboards seem to be working better now. ... View more