topic Re: Issue with Palo Alto apps in Getting Data In

Issue with Palo Alto apps

gskorski — Fri, 02 Mar 2012 15:33:54 GMT

I have an issue with the Palo Alto apps.
It seems that the transforms doesn't work.
I can see my Palo Alto logs in the search apps but nothing in the Palo Alto apps.
I'm running the latest version 1.2.0 and Splunk v4.3.

Can you help me?

Re: Issue with Palo Alto apps

MarioM — Sat, 03 Mar 2012 10:29:36 GMT

As Splunk indexes your Palo Alto Networks firewall data, the app will rename the sourcetypes to pan_threat, pan_traffic, pan_config, and pan_system depending on the logging facility in your firewall.

This rename expect to find THREAT,TRAFFIC,CONFIG,SYSTEM, keywords in your Palo Alto data

And origin sourcetype need to be pan_log

Re: Issue with Palo Alto apps

gskorski — Mon, 05 Mar 2012 11:35:00 GMT

The issue is that the sourcetype is not renamed. So the application doesn't find any logs.

Re: Issue with Palo Alto apps

MarioM — Mon, 05 Mar 2012 20:25:59 GMT

This rename expect to find THREAT,TRAFFIC,CONFIG,SYSTEM, keywords in your Palo Alto data

And origin sourcetype need to be pan_log

Re: Issue with Palo Alto apps

gskorski — Thu, 08 Mar 2012 16:50:37 GMT

I know that.

The sourcetype is well configured as pan_log, and I can find THREAT, TRAFFIC, CONFIG and SYSTEM keyword in the logs but the app doesn't display anything.

Re: Issue with Palo Alto apps

willthames2 — Tue, 03 Apr 2012 00:54:04 GMT

We have the exact same problem. Interesting to know if anyone has a solution. sourcetype=pan_log finds lots of logs containing the regex ,TRAFFIC, as per transforms.conf