Empty Dashboards: How to configure inputs.conf for Splunk for Palo Alto Networks app to index data from syslog server?

[JSapienza]

We already have the pan devices logging to our syslog-ng server. I have deployed the the following inputs.conf to the forwarder:

# syslog forwarder inputs
  [monitor:///var/log/syslog/PaloAlto/]
  host_segment = 5
  index = pan_logs
  sourcetype = pan_log
  blacklist = \.(gz|bz2)$

Data is hitting the pan_logs index however none of the dashboards are populating. After looking at some of the searches I noticed other pan sourcetypes that are not being populated. I assume these are supposed to be rewritten at index time? . All data in the pan_logs index is sourcetype = pan_log. Any ideas ?

[kbecker]

Are you running a heavy forwarder on your syslog server that is then forwarding data to your Splunk indexers? If so you will need to copy the props and transforms files from the pan app to the heavy forwarder on your syslog server. Had this same issue a few weeks ago and this resolved the problem.

[JSapienza]

I am using the universal forwarder on the syslog server. So this wouldn't work in this instance .