How to configure the Splunk for Palo Alto Networks app to index Palo Alto logs in Splunk?

[pavanae]

I had already installed the Splunk for Palo Alto Networks app in Splunk. Can anyone please tell what were the steps to proceed to get those logs and how to configure this in a detailed answer?

[kent_farries · Accepted solution]

The documentation in the app is really good so I would start there and if your having troubles after following those detailed steps post the issue here.

https://splunkbase.splunk.com/app/491/#/documentation

If you are using Panorama to collected all your logs from all the PAN's then it is best to have Panorama forward the logs to the UDP port that you have configured in Splunk. If you don't have Panorama then you will need to configure each PAN Firewall to forward the logs to Splunk.