No supported files to process

[mr.linus]

Hey,

I have an issue using the ML learning part of Expedition tool.

Expedition: 1.1.3
Spark dependencies: 0.1.1
Best Practices: 3.6.3

1) I have uploaded some logs in the past and was able to process them. This is all in a lab environment, and those logs are no longer relevant. Is there a way to remove these processed log files?

2) I have now uploaded new logs. But when I try to process them -> it gives me an error: "No supported files to process". Any idea how to fix this? 

[dgildelaig]

The only option to delete already processed logs (converted to parquet) is to delete the Temporary Data Structure that is present in the ML Settings tab.

However, this will delete all the processed data.

Internally, this actually deletes a folder (and the files inside) called connections.parquet, that it is present in your Temporary Data Structure path. You could backup that folder if you wish.

The second question seems to be a bug to me. You actually have a file in the list that can be processed. Therefore, there should not be such a problem processing that file.

Could you contact us at fwmigrate at paloaltonetworks dot com to check additional debug messages?

Thanks

[anuj_mor]

@dgildelaig @mr.linus  The fix is easy (atleast it worked for me!). When you specific the folder and search the CSV file, before hitting the process button, first click Save button and then reopen the M.LEARNING tab and click Process Files. It should work.

[Ching]

That fixed for me as well.

[dgildelaig]

We will be releasing an update today that would consider the path even if the Save button has not been clicked.

[soc.gnp]

Hello!!

We are trying to process logs from 8.1.11 version however appears Unsupported.

Do you have any idea how to solve?

[dgildelaig]

Try updating to the latest version to make sure it is not resolved in that one.

Also make sure that it is a complete and not malformed CSV file, so it can understand the internal format of the data and identifies the fields that PANOS 8.1 would report.

[CDeBella]

You have GOT to be kidding me.  This worked for me after spending over an hour reading through forum posts.