Using version 3.4 on Splunk 5.140868
I have our PA data correctly being indexed to Pan_Logs, data seems to correctly be categorized into the correct sourcetypes and the dashboards are working as expected, however when I click on any of the charts, or click "Threat Details" to get more granular data, the results are empty. The macro pan_threat does return data.
Also, when I click "View Full Report" it looks like it's searching for * within all the indexes on our server. That doesn't sound right.
We are sending everything over (url, threat, system, config) except traffic since that's a bit of a data hog. Is there something I'm missing to get the details working? Does it rely on the traffic data? I'm assuming the Threat Details might as it says "This dashboard provides additional detail on traffic generated by activities related to threats."