diff --git a/README.md b/README.md
index 23ff9768..a0216bbc 100755
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ Networks Firewall
#### Version ####
* Splunk Version: 6.x
-* App Version: 4.0
+* App Version: 4.0.1
* Last Modified: Oct 2013
* Authors:
* Monzy Merza - Splunk, Inc.
@@ -126,7 +126,7 @@ NetFlow graphs and charts are based on NetFlow data produced by Palo Alto Networ
Steps to configure:
- Install NetFlow Integrator on a separate server or together with Splunk Forwarder
-- Point Palo Alto Networks device NetFlow settings to NetFlow Integrator server, default port 9995 with PAN-OS Field Types enabled (see [Administrator's Guide] (https://live.paloaltonetworks.com/community/documentation/content?filterID=contentstatus[published]~category[administrators-guide]&filterID=contentstatus[published]~objecttype~objecttype[document]&itemView=detail))
+- Point Palo Alto Networks device NetFlow settings to NetFlow Integrator server, default port 9995 with PAN-OS Field Types enabled (see [Administrator's Guide](https://live.paloaltonetworks.com/community/documentation/content?filterID=contentstatus[published]~category[administrators-guide]&filterID=contentstatus[published]~objecttype~objecttype[document]&itemView=detail))
- Enable NetFlow in the Splunk for Palo Alto Networks app setup page
- Restart Splunk for the previous change to take effect
- Add NetFlow Integrator output pointing to Splunk UDP port 10514
@@ -155,6 +155,11 @@ Dashboards are built with SimpleXML, so they can be modified using the Splunk GU
## What's new in this version ##
+Version 4.0.1
+
+- Fix: Config dashboard shows all events
+- Fix: Better handling of navbar changes
+
Version 4.0
- Splunk 6 support
diff --git a/appserver/controllers/nfi_nav_handler.py b/appserver/controllers/nfi_nav_handler.py
index 7b28f737..f6eed4ed 100644
--- a/appserver/controllers/nfi_nav_handler.py
+++ b/appserver/controllers/nfi_nav_handler.py
@@ -6,14 +6,11 @@
APP = 'SplunkforPaloAltoNetworks'
ENABLED_NAV = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', APP, 'default', 'data', 'ui', 'nav', 'default.xml.nfi_enabled')
DISABLED_NAV = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', APP, 'default', 'data', 'ui', 'nav', 'default.xml.nfi_disabled')
-NAV_DIR = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', APP, 'local', 'data', 'ui', 'nav')
-NAV = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', APP, 'local', 'data', 'ui', 'nav', 'default.xml')
+NAV = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', APP, 'default', 'data', 'ui', 'nav', 'default.xml')
class NAVHANDLER(controllers.BaseController):
@expose_page(must_login=True, methods=['GET'])
def enable(self, **kwargs):
- if not os.path.exists(NAV_DIR):
- os.makedirs(NAV_DIR)
try:
shutil.copy(ENABLED_NAV, NAV)
except:
@@ -21,8 +18,6 @@ def enable(self, **kwargs):
return 'Enabled!'
@expose_page(must_login=True, methods=['GET'])
def disable(self, **kwargs):
- if not os.path.exists(NAV_DIR):
- os.makedirs(NAV_DIR)
try:
shutil.copy(DISABLED_NAV, NAV)
except:
diff --git a/default/app.conf b/default/app.conf
index 8adda24f..26e8b983 100755
--- a/default/app.conf
+++ b/default/app.conf
@@ -5,7 +5,7 @@ label = Splunk for Palo Alto Networks
[launcher]
author= btorres-gil@paloaltonetworks.com
description= The Splunk for Palo Alto Networks app is a set of field extractions, reports, lookups and dashboards which provide visibility into the Palo Alto Networks Firewall data.
-version = 4.0
+version = 4.0.1
[package]
id= SplunkforPaloAltoNetworks
diff --git a/default/data/ui/views/config_overview.xml b/default/data/ui/views/config_overview.xml
index 8022cdc3..709d1204 100644
--- a/default/data/ui/views/config_overview.xml
+++ b/default/data/ui/views/config_overview.xml
@@ -27,15 +27,15 @@
FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby host
| eval host_with_count = host . " (" . count . ")"
-
-
+
+
- client="
+ client_type="
"
ANY
- |tstats count(client) as count
- FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby client
- | eval client_with_count = client . " (" . count . ")"
+ |tstats count(client_type) as count
+ FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby client_type
+ | eval client_type_with_count = client_type . " (" . count . ")"
@@ -71,7 +71,7 @@
Latest Events
- | tstats count(admin) FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$ $result$ $cmd$ $vsys$ groupby _time result serial_number host admin client cmd configuration_path | table _time result serial_number host admin client cmd configuration_path result | sort -_time
+ | tstats count(admin) FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client_type$ $result$ $cmd$ $vsys$ groupby _time result serial_number host admin client_type cmd configuration_path | table _time result serial_number host admin client_type cmd configuration_path result | sort -_time
$earliest$
$latest$
@@ -118,9 +118,9 @@
/app/SplunkforPaloAltoNetworks/search?q=`pan_config` admin="$row.admin$"&earliest=$earliest$&latest=$latest$
]]>
-
+
@@ -134,7 +134,7 @@
Config Events
- | tstats count(cmd) AS cr FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$
+ | tstats count(cmd) AS cr FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client_type$
$result$ $cmd$ $vsys$ groupby _time cmd| timechart values(cr) by cmd
$earliest$
$latest$
@@ -161,7 +161,7 @@
Configuration Administrators
- | tstats count(admin) AS ca FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$ $result$ $cmd$ $vsys$ groupby _time admin | timechart values(admin) by admin
+ | tstats count(admin) AS ca FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client_type$ $result$ $cmd$ $vsys$ groupby _time admin | timechart values(admin) by admin
$earliest$
$latest$
@@ -189,7 +189,7 @@
Clients Used
- | tstats count(client) AS cc FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$ $result$ $cmd$ $vsys$ groupby client
+ | tstats count(client_type) AS cc FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client_type$ $result$ $cmd$ $vsys$ groupby client_type
$earliest$
$latest$
@@ -215,7 +215,7 @@
Results
- | tstats count(result) AS cr FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$ $result$ $cmd$ $vsys$ groupby result
+ | tstats count(result) AS cr FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client_type$ $result$ $cmd$ $vsys$ groupby result
$earliest$
$latest$
diff --git a/default/savedsearches.conf b/default/savedsearches.conf
index 3cf6c3e4..7de68d16 100755
--- a/default/savedsearches.conf
+++ b/default/savedsearches.conf
@@ -109,7 +109,7 @@ displayview = flashtimeline
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_view = flashtimeline
-search = `pan_config` | table _time vsys host admin client cmd configuration_path result serial_number log_subtype | fillnull value="" configuration_path | tscollect namespace=pan_config
+search = `pan_config` | table _time vsys host admin client_ip client_type cmd configuration_path result serial_number log_subtype | fillnull value="" configuration_path | tscollect namespace=pan_config
disabled = 0
[PAN - Traffic - Applications]