All Apps and Add-ons

Empty Dashboards: How to configure inputs.conf for Splunk for Palo Alto Networks app to index data from syslog server?

JSapienza
Contributor

We already have the pan devices logging to our syslog-ng server. I have deployed the the following inputs.conf to the forwarder:

# syslog forwarder inputs
  [monitor:///var/log/syslog/PaloAlto/]
  host_segment = 5
  index = pan_logs
  sourcetype = pan_log
  blacklist = \.(gz|bz2)$

Data is hitting the pan_logs index however none of the dashboards are populating. After looking at some of the searches I noticed other pan sourcetypes that are not being populated. I assume these are supposed to be rewritten at index time? . All data in the pan_logs index is sourcetype = pan_log. Any ideas ?

0 Karma

kbecker
Communicator

Are you running a heavy forwarder on your syslog server that is then forwarding data to your Splunk indexers? If so you will need to copy the props and transforms files from the pan app to the heavy forwarder on your syslog server. Had this same issue a few weeks ago and this resolved the problem.

JSapienza
Contributor

I am using the universal forwarder on the syslog server. So this wouldn't work in this instance .

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...