All Apps and Add-ons

Cortex Data Lake - missing field in logs breaks parsing

TitanAE2020
Loves-to-Learn

I am currently using the Splunk TA for Palo Alto data.  And I'm ingesting data from Cortex Data Lake to a new Azure Syslog server.

But there is a large problem with the data we're ingesting.  The data being sent is literally missing a single field.  Below is a reference of what we should be ingesting:

Configuration Syslog Field Order (paloaltonetworks.com)

If you look at the example from this link, you will see this log:

 

Oct 13 20:56:15 gke-standard-cluster-2-pool-1-6ea9f13a-fnid 394 <142>1 2020-10-13T20:56:15.519Z stream-logfwd20-156653024-10121421-eq28-harness-16kn logforwarder - panwlogs - 1,​2020-10-13T20:56:03.000000Z,​007051000113358,​CONFIG,​config,​,​2020-10-13T20:56:00.000000Z,​xxx.xx.x.xx,​,​rename,​admin,​,​submitted,​/config/shared/log-settings/globalprotect/match-list/entry[@name='rs-globalprotect'],​150,​-9223372036854775808,​0,​0,​0,​0,​,​PA-VM,​,​,​,​2020-10-13T20:56:00.284000Z

But what I'm receiving is:

Oct 13 20:56:15 gke-standard-cluster-2-pool-1-6ea9f13a-fnid 394 <142>1 2020-10-13T20:56:15.519Z stream-logfwd20-156653024-10121421-eq28-harness-16kn logforwarder - panwlogs - ​2020-10-13T20:56:03.000000Z,​007051000113358,​CONFIG,​config,​,​2020-10-13T20:56:00.000000Z,​xxx.xx.x.xx,​,​rename,​admin,​,​submitted,​/config/shared/log-settings/globalprotect/match-list/entry[@name='rs-globalprotect'],​150,​-9223372036854775808,​0,​0,​0,​0,​,​PA-VM,​,​,​,​2020-10-13T20:56:00.284000Z

In the log I'm receiving, I'm missing a comma (,) before the 2020 in this line:

harness-16kn logforwarder - panwlogs - ​2020-10-13T20:56:03.000000Z
 
I should be receiving data that looks like this:
 
harness-16kn logforwarder - panwlogs - 1,​2020-10-13T20:56:03.000000Z
 
I'm at a loss where this data is generated.  If this is data generated by a syslog server, the unix server hosting syslog, or if it's on the Palo Alto Cortex Data Lake side of things. The logs are passed through our firewall and towards the syslog server.
 
I believe this field is either 'log_source_id' or 'log_type.value'.  But outside of that, I'm at a loss as to where this value is generated.  Any help is appreciated.
 
- TitanAE

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...