All Apps and Add-ons

Splunk for Palo Alto Networks: Why am I not getting any data in the pan_logs index?

arcticgenes
New Member

I'm experiecing an issue with getting data into my splunk index for pan_logs.

It was working for a time and then something changed. I can see the logs hitting my heavy forwarders if I do a tcpdump on the port the inputs.conf stanza is configured for. I have the palo alto app installed on the heavy forwarder to process all the transforms and props. The problem is the i'm not getting any data into the pan_logs index. I have tried updating the app on the heavy forwarder but no luck. The index exists.

Any suggestions?

0 Karma

neelamssantosh
Contributor

Check with search: index=** sourcetype=pan*
then figure out to which index data is being indexed to.
unable to type single asterisk sign
Hope it will help.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...