topic Re: Palo Alto App not doing sourcetype transform in Getting Data In

Palo Alto App not doing sourcetype transform

xxkenta — Tue, 05 Jun 2018 19:25:17 GMT

Hello

I have data being sent from Palo Alto to our syslog server. I have set it up following the guide here: https://splunk.paloaltonetworks.com/universal-forwarder.html

I now have also installed the Palo Alto add-on and the app. I have the data in splunk showing up as sourcetype = pan:log but none of the transforms are happening so therefor the app is not working.

What should I check to troubleshoot this?

Thanks.

Re: Palo Alto App not doing sourcetype transform

adonio — Tue, 05 Jun 2018 19:41:21 GMT

did you install the TA on Search Head and Indexer?

Re: Palo Alto App not doing sourcetype transform

xxkenta — Tue, 05 Jun 2018 19:43:59 GMT

The search head and indexer are on the same server so yes!

Re: Palo Alto App not doing sourcetype transform

adonio — Tue, 05 Jun 2018 20:13:48 GMT

are you searching in verbose mode?
is the sourcetype transform happens than you supposed to see fields
on the link you posted:
https://splunk.paloaltonetworks.com/universal-forwarder.html
scroll down all the way to step 4 and verify

Re: Palo Alto App not doing sourcetype transform

xxkenta — Thu, 07 Jun 2018 12:42:11 GMT

Yes I am searching in verbose mode
I have verified step four but the sourcetype transforms are not working.
I can search by the source and get "sourcetype=pan:log"

Re: Palo Alto App not doing sourcetype transform

HiroshiSatoh — Thu, 07 Jun 2018 13:05:07 GMT

First check whether the log is the source type.

index=your_index  sourcetype=pan*

It is other than "pan: log" if it is linked properly.

If the log is correctly captured and the screen is not displayed, the following causes may be considered.

· You are not accelerating the data model.
· The original log is customized.

Re: Palo Alto App not doing sourcetype transform

quinneyc — Tue, 09 Jan 2024 17:05:23 GMT

Greetings @xxkenta

Were you ever able to find a viable solution for this issue? I'm having a similar situation.