Yikes...the further I dig, the further it looks like something is really wrong in the data model vs what the dashboards are pulling. Looking at the globalprotect dashboard, it's looking for log.system.globalprotect, which doesn't exist as a field in the data model (there's lots of other log.* items...but nothing even remotely similar to the field above). ... View more