Palo Alto App

the_rains — Mon, 29 Nov 2021 16:05:15 GMT

Hi All

Hoping someone can help me, I am trying to get the Palo Alto App working we are a Splunk cloud customer and have this app on our search-head

When I search for eventype=pan I see the logs but they are NOT reclassified

Our set up is we have our Palo Alto firewalls pushing to a syslog server on standard port 514, this data at the moment is currently being ingested as one syslog stream via universal forwarder, where the sourcetype=syslog and index=syslog.

In inputs.conf in

/opt/splunk/etc/system/local I have configured the below

[monitor:///data/rsyslog/10.0.0.1/10.0.0.1.log]

index = pan_logs

sourcetype = pan:log

host_segment = 3

The guide states to configure your TCP outputs in

/ opt/splunkforwarder/etc/system/local/outputs.conf in this file we have

[tcpout]

indexAndForward = 1

As a cloud customer we have our company app in root@syslog:/opt/splunk/etc/apps/OUR_COMPANY_APP/default

The outputs.conf has but no input file

= inputs1.name.splunkcloud.com:9997,

inputs2.name.splunkcloud.com:9997,

inputs3.name.splunkcloud.com:9997,

inputs4.name.splunkcloud.com:9997,

inputs5.name.splunkcloud.com:9997,

inputs6.name.splunkcloud.com:9997,

The input file being used is

oot@syslog:/opt/splunk/etc/apps/search/local

The PaloAlto app states to add your indexers to Create or modify/opt/splunkforwader/etc/system/local/outputs.conf

and add a tcpout stanza:

Could I copy over the outputs from root@syslog:/opt/splunk/etc/apps/OUR_COMPANY_APP/default to /opt/splunkforwader/etc/system/local/outputs.conf

topic Palo Alto App in Getting Data In

Palo Alto App