Getting Data In

Issue with Palo Alto apps

gskorski
Explorer

I have an issue with the Palo Alto apps.
It seems that the transforms doesn't work.
I can see my Palo Alto logs in the search apps but nothing in the Palo Alto apps.
I'm running the latest version 1.2.0 and Splunk v4.3.

Can you help me?

Tags (3)

willthames2
Path Finder

We have the exact same problem. Interesting to know if anyone has a solution. sourcetype=pan_log finds lots of logs containing the regex ,TRAFFIC, as per transforms.conf

0 Karma

gskorski
Explorer

The issue is that the sourcetype is not renamed. So the application doesn't find any logs.

0 Karma

MarioM
Motivator

This rename expect to find THREAT,TRAFFIC,CONFIG,SYSTEM, keywords in your Palo Alto data

And origin sourcetype need to be pan_log

0 Karma

MarioM
Motivator

As Splunk indexes your Palo Alto Networks firewall data, the app will rename the sourcetypes to pan_threat, pan_traffic, pan_config, and pan_system depending on the logging facility in your firewall.

This rename expect to find THREAT,TRAFFIC,CONFIG,SYSTEM, keywords in your Palo Alto data

And origin sourcetype need to be pan_log

0 Karma

gskorski
Explorer

I know that.

The sourcetype is well configured as pan_log, and I can find THREAT, TRAFFIC, CONFIG and SYSTEM keyword in the logs but the app doesn't display anything.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...