I am currently using the Splunk TA for Palo Alto data.  And I'm ingesting data from Cortex Data Lake to a new Azure Syslog server. But there is a large problem with the data we're ingesting.  The data being sent is literally missing a single field.  Below is a reference of what we should be ingesting: Configuration Syslog Field Order (paloaltonetworks.com) If you look at the example from this link, you will see this log:   Oct 13 20:56:15 gke-standard-cluster-2-pool-1-6ea9f13a-fnid 394 <142>1 2020-10-13T20:56:15.519Z stream-logfwd20-156653024-10121421-eq28-harness-16kn logforwarder - panwlogs - 1,​2020-10-13T20:56:03.000000Z,​007051000113358,​CONFIG,​config,​,​2020-10-13T20:56:00.000000Z,​xxx.xx.x.xx,​,​rename,​admin,​,​submitted,​/config/shared/log-settings/globalprotect/match-list/entry[@name='rs-globalprotect'],​150,​-9223372036854775808,​0,​0,​0,​0,​,​PA-VM,​,​,​,​2020-10-13T20:56:00.284000Z But what I'm receiving is: Oct 13 20:56:15 gke-standard-cluster-2-pool-1-6ea9f13a-fnid 394 <142>1 2020-10-13T20:56:15.519Z stream-logfwd20-156653024-10121421-eq28-harness-16kn logforwarder - panwlogs - ​2020-10-13T20:56:03.000000Z,​007051000113358,​CONFIG,​config,​,​2020-10-13T20:56:00.000000Z,​xxx.xx.x.xx,​,​rename,​admin,​,​submitted,​/config/shared/log-settings/globalprotect/match-list/entry[@name='rs-globalprotect'],​150,​-9223372036854775808,​0,​0,​0,​0,​,​PA-VM,​,​,​,​2020-10-13T20:56:00.284000Z In the log I'm receiving, I'm missing a comma (,) before the 2020 in this line: harness-16kn logforwarder - panwlogs - ​2020-10-13T20:56:03.000000Z   I should be receiving data that looks like this:   harness-16kn logforwarder - panwlogs - 1,​2020-10-13T20:56:03.000000Z   I'm at a loss where this data is generated.  If this is data generated by a syslog server, the unix server hosting syslog, or if it's on the Palo Alto Cortex Data Lake side of things. The logs are passed through our firewall and towards the syslog server.   I believe this field is either 'log_source_id' or 'log_type.value'.  But outside of that, I'm at a loss as to where this value is generated.  Any help is appreciated.   - TitanAE     ... View more

Hey everyone, happy friday to you all.  I'm currently looking into upgrade our older Splunk 7.0 software to at least version 8.0 (if not higher).  But I wanted to get some advice from some users who've been through this before. My biggest question/concern is the upgrade process itself.  Reading the documentation makes it sound simple: 1. unpacking the new version of Splunk in the same directory as the original 2. letting the migration script run 3. re-indexing our data.  Again... seems a bit to easy.  And I've read that most people have to upgrade along these lines: * Go to version 7.0 - 7.1 - 7.2 -7.3 - 8.0 Further more there is also ensure App and TA combability is still a thing.  Something I'm working through listing out. But because of how detailed this upgrade feels I wanted to ask the communities advice on what I should expect.  And if there are any pain points I might not be aware of going forward. Thanks - Titan ... View more

I'm currently looking at increasing the performance of our Splunk Search Head. I'm running a number of Apps at the request of my network engineer. However I'm noticing a number of things: Max Current Search is at 12. It appears to be limited by the indexer (4 cores) Accelerating Data Models isn't hitting my search head hard, but it's behind. Possibly do to limited searches/skipped searches on. InfoSec and Palo Alto's app run about an hour behind and incredibly slow. It's kind of frustrating. Should mention that I'm currently running Splunk Indexer and Splunk Search Head (seperate servers) in Azure. Things seem descent in Azure. And am increasing the instance. But some other things I'm thinking of doing: Increasing the maximum concurrent searches on the indexer and search head from 3 to 4. I'm fairly optimistic the servers can handle it. Increasing the Azure instance. Currently using Azure B4ms for the Indexer, and B8ms for the Search Head. Realizing that might not be the best configuration... pardon my previous ignorance on these topics. Before I invest in these, I'd love to get the Splunk Communities input on all of this. I admit, Splunk is becoming very App-Heavy. Which I'm not pleased about. So any ways of increasing performance is appreciated. Aw, one last thing. I'm still fairly new to data modeling. Though I've worked with the CIM I haven't tagged everything. I'm wondering if limiting the tags to specific Data Models would be of great benefit to performance, or just harm it. ... View more