I have some of the dashboards showing information and some do not.  Currently I'm working on getting the global protect dashboard to show information. While I do see global protect listed in some of the log files while looking at Pan:system; I do not see "log_subtype="globalprotect"". I do see the following log subtypes: vpn general auth userid url-filtering   I unfortunately have no idea how to tell the system how to parse the data for globalprotect.   Ian ... View more

I'm sending my log files to splunk from a syslog server using a universal forwarder.  They are getting to the right index and the hostnames are being extracted fine.  The problem is, nothing else is parsing properly.  When I choose sourcetype=pan all i get is pan_log.  Its not parsing out the data into the appropriate types (i.e. threat, url, etc).  Here is a copy of my inputs.conf [monitor://C:\Program Files (x86)\Syslogd\Logged Devices\] host_segment = 5 sourcetype = "pan:log" no_appending_timestamp=true index=pan_logs disabled = false   The source directory is formatted as follows:   C:\Program Files (x86)\Syslogd\Logged Devices\PaloAlto Firewalls\%firewall model%\%ip_address%--Syslog-2021-01-21.txt   any thoughts?   Ian ... View more

We have 3 palo alto firewalls that I'm sending syslog data to a solarwinds kiwi syslog server.  I am having kiwi write the logs to disk and have the splunk universal forwarder send the logs to my splunk environment.  I have 2 issues which I can't seem to figure out (even after looking at various posts here that mention similar scenarios).   1)  The Palo Alto app states that there is only 1 firewall.  When i look in the logs that "firewall" is the kiwi syslog server.      I have tried adding a Host variable to the inputs (no such luck).  Tried having kiwi just forward the logs               directly to splunk (no such luck).  I have even tried to have kiwi just send the raw data.  In every case kiwi         is appending its own date / time stamp and host value in front of the palo alto messages.  I'm not sure               how to completely strip that information. 2)  The Palo Alto see's the source type as Pan:Logs, but it is not seperating them into their perspective logs:  i.e. Pan:Firewall, Pan:System, Pan:traffic etc..      I have seen suggestions to use a transforms file and / or a props file, but I'm just too new to understand             how to configure them properly. Any help would be appreciated.     ... View more

The Clearpass app is displaying data, however, it is missing populating major fields. when I look at the Search I also see these field missing in the search interesting fields, even though these fields exist in the raw data. Here is a list of the missing fields: user_name mac_addrees ip_address mac_vendor There may be more but it just appears that the indexer isn't indexing these fields.... Any ideas? ... View more