Getting Data In

Issue with Palo Alto apps

gskorski
Explorer

I have an issue with the Palo Alto apps.
It seems that the transforms doesn't work.
I can see my Palo Alto logs in the search apps but nothing in the Palo Alto apps.
I'm running the latest version 1.2.0 and Splunk v4.3.

Can you help me?

Tags (3)

willthames2
Path Finder

We have the exact same problem. Interesting to know if anyone has a solution. sourcetype=pan_log finds lots of logs containing the regex ,TRAFFIC, as per transforms.conf

0 Karma

gskorski
Explorer

The issue is that the sourcetype is not renamed. So the application doesn't find any logs.

0 Karma

MarioM
Motivator

This rename expect to find THREAT,TRAFFIC,CONFIG,SYSTEM, keywords in your Palo Alto data

And origin sourcetype need to be pan_log

0 Karma

MarioM
Motivator

As Splunk indexes your Palo Alto Networks firewall data, the app will rename the sourcetypes to pan_threat, pan_traffic, pan_config, and pan_system depending on the logging facility in your firewall.

This rename expect to find THREAT,TRAFFIC,CONFIG,SYSTEM, keywords in your Palo Alto data

And origin sourcetype need to be pan_log

0 Karma

gskorski
Explorer

I know that.

The sourcetype is well configured as pan_log, and I can find THREAT, TRAFFIC, CONFIG and SYSTEM keyword in the logs but the app doesn't display anything.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...