About SCSM_Martin

SCSM_Martin · ‎12-19-2014

I finally found the problem. NTP wasn't working correctly because of firewall rules, so the system time of the Splunk server was wrong. I soon as I had NTP synced up, the dashboards started to work correctly. The system time was about 5 hours off, so that screwed up the dashboards that are using last 60 minutes by default. Thanks for your help!

SCSM_Martin · ‎12-09-2014

I ran "index=pan_logs|head 10" and got events listed in local time. I think the problem is related to timezones because I'm GMT -5 (Eastern) and when I search for events in the last 5 hours, I only get events for the current minute (223 events (12/9/14 4:20:41.000 PM to 12/9/14 9:20:41.000 PM). It is currently 4:20 PM. Is there a way to correct the timezone behaviour? Thank you!

SCSM_Martin · ‎12-09-2014

Thanks for taking the time to help me with this issue. I think the problem lies with relative dates. When I click on the dashboard to open the query in the Search tab, I don't have any result. But, when I change the time definition from "Last 60 minutes" to "All time", I have results! I have the same problem with a simple "index=pan_logs" query. As soon as I choose a "Last X minutes" query, I get no results. Any clue on what can be causing this? I'm a Splunk newb, but really eager to learn.

SCSM_Martin · ‎12-09-2014

Hi! Unfortunately, I'm still in the same state. I can see the logs in the Search tab, but all dashboards are still blank (0 or No results found). Thanks for your help.

SCSM_Martin · ‎12-04-2014

Hi, I just did a brand new installation of Splunk Enterprise 6.2 on FreeBSD 9.3 and installed the Palo Alto app version 4.2. I followed the instructions for the installation and was able to ran successfully the search commands to validate my installation. "index=pan_logs sourcetype=pan_config" and "index=pan_logs" returns me all the logs from the FW. I looked in Settings--Data Model and the Firewall Logs acceleration is 100% completed. What I find strange is that when I look at the "Data Summary" in the Search tab, I don't see anything related to Palo Alto. I can only see the other data that was injected in Splunk (CSV files and syslog which are both working fine). Is it normal? What should I be looking at to troubleshoot further? Thank you! Martin,

Posts	5
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎12-04-2014

Online Status	Offline
Date Last Visited	‎04-26-2021 02:06 PM

Splunk for Palo Alto Networks 4.2: Data indexed, b...

Re: Splunk for Palo Alto Networks 4.2: Data indexe...

Re: Splunk for Palo Alto Networks 4.2: Data indexe...

Re: Splunk for Palo Alto Networks 4.2: Data indexe...

Re: Splunk for Palo Alto Networks 4.2: Data indexe...

Splunk for Palo Alto Networks 4.2: Data indexed, b...