All Apps and Add-ons

Palo Alto logs + Syslog not showing up Palo Alto Add-On

tentontitan
New Member

I'm currently collecting Palo Alto traffic via Syslog. I'm then shooting it up to a single indexer that has both the Palo Alto App & Add-On.

[monitor:palo_logs.log]
sourcetype = pan:log
source = syslog
host = x.x.x.x
disabled = false
interval = 600    

While I can search through the data as though it were any other Splunk log, the Palo Alto APP & Add-On are not recognizing or transforming the data. Meaning I do not see any events or dashboards in those apps.

Also the sourcetype = pan:log in splunk. However the documentation specifies other source types:

Palo Alto Add-On Documentation

If someone can help me determine what I'm doing wrong, I would appreciate.

0 Karma

Eric_Mcknight
Explorer

Thanks to validate:

  1. Make sure the add-on is installed on your forwarder.
  2. Me personally, i install the app and add-on on my HEAVY forwarder syslog server, and don't install it on my indexers. Actually reduces indexer load by quite a bit.
  3. Make sure the app and add-on are installed on your search head.
0 Karma

tentontitan
New Member

Interesting. I'm currently using a universal forwarder to send data to Splunk. But you're saying that won't work. And that I have to use the heavy forwarder to forward and send the data properly. That way the transformations take place on the heavy forwarder and send it to your indexer.

I'll need to experiment.

0 Karma

Eric_Mcknight
Explorer

Things to check:

  1. Configuration looks just fine.
  2. Make sure the add-on is installed on your forwarder.
  3. Make sure the APP and Add-on are installed on your search heads.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...