I had the same problem with the same dashboard. I found that the index=threat_activity wasn't being populated either. Splunk support had me do the following: Please remove the following from etc/apps/TA-paloalto/local/macros.conf [tstats] definition = tstats summariesonly=t # definition = tstats prestats=true local=`tstats_local` Several of the searches were not completing due to scheduler limits. I would look for status=skipped in the scheduler.log file. 07-09-2015 12:54:56.128 -0700 INFO SavedSplunker - savedsearch_id="nobody;DA-ESS-ThreatIntelligence;_ACCELERATE_DM_DA-ESS-ThreatIntelligence_Threat_Intelligence_ACCELERATE_", user="nobody", app="DA-ESS-ThreatIntelligence", savedsearch_name="_ACCELERATE_DM_DA-ESS-ThreatIntelligence_Threat_Intelligence_ACCELERATE_", status=skipped, reason="maxsearches limit reached", scheduled_time=1436471400 Modified /opt/splunk/etc/system/local/limits.conf and increased the two settings for the scheduler section. [scheduler] max_searches_perc = 70 auto_summary_perc = 75 ... View more