We're trying to deploy the SPLUNK FOR PALO ALTO app in our environment (Windows). The app seems to have loaded correctly, as well as the required resources from the apps page.
We setup the configs on the Palo Alto side and traffic appears to be hitting the Splunk environment however nothing is showing up in Splunk.
The inputs.conf file is defined as:
[udp://514]
index = pan_logs
connection_host = ip
sourcetype = pan_log
no_appending_timestamp = true
disabled = 0
With the macros.conf file as:
[pan_index]
definition = index=pan_logs
[pan_threat]
definition = pan_index (sourcetype="pan_threat" OR sourcetype="pan_threat-2050") NOT "THREAT,url"
[pan_threat_all]
definition = pan_index (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
[pan_traffic]
definition = pan_index sourcetype="pan_traffic"
[pan_system]
definition = pan_index sourcetype="pan_system"
[pan_config]
definition = pan_index sourcetype="pan_config"
[pan_web_activity]
definition = pan_index "THREAT,url" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
[pan_url]
definition = pan_index "THREAT,url" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
[pan_data_filtering]
definition = pan_index "THREAT,data" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
[pan_data]
definition = pan_index "THREAT,data" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
[pan_wildfire]
definition = pan_index "THREAT,wildfire" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
[pan_wildfire_report]
definition = pan_index sourcetype="pan_wildfire_report"
[tstats]
definition = tstats
definition = tstats prestats=true local= tstats_local
[tstats_local]
definition = false
... View more