All Apps and Add-ons

Palo Alto Networks App/Add-on not showing data with custom index

darizotas
New Member

Platform: Splunk and Palo Alto Networks App/Add-on latest release.

Following the installation instructions it looks like you can configure the Palo Alto Networks App/Add-on to a custom index. If I perform a search: index=my_custom_index eventtype=pan within the Add-On, it works. Without indicating the index, it does not.

On top of that the App is unable to populate the dashboards. I have added the local/inputs.conf to the App and Add-on with the configuration:

App version 5.x/6.x with Add-on

[udp://514]
connection_host = ip
index = network
sourcetype = pan:log
no_appending_timestamp = true

But no luck. Has anyone experienced something similar?

Thanks,
D

0 Karma

darizotas
New Member

@micahkemp, you are in the right track. I found this pull request in the Github repo of the application that points to the solution (still under development):

https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/pull/15

Thanks for answering!

0 Karma

micahkemp
Champion

It sounds like your custom index is not included in the list of indexes to search by default. Refer to the documentation to look into how this can be changed.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...