I set up the Palo Alto Networks App for Splunk, but all of the dashboards are blank except for the overview. The firewall is configured to send the log data via syslog (not using 514 as it is already being used). I verified that I am getting traffic, threat, configuration log data, however, none of the dashboards are populating with new data other than the overview dashboard.
I verified that I am getting new log data by running `pan_traffic` and `pan_threat` and selecting a 30 second time Window for real-time.
I had this issue with 5.1.x and I upgraded to 5.2.0 since I had recently upgraded the PANOS (TA is at version 3.6.1), but the dashboards are still empty. I was prompted to set the app back up after the upgrade, but everything needed was already in the configuration file so I just clicked save. Same results, Overview works, but none of the other dashboards.
Versions:
Splunk: 6.3.3
PAN App: 5.2.0
TA: 3.6.1
Thanks,
Sean
↧