All Apps and Add-ons

PAN-OS 9.1.1 Breaks Data Model?

gfisbeck
Explorer

My network team upgraded our Palo Altos to 9.1.1 and it looks like Palo Alto may have changed the format of GlobalProtect logs... I'm no longer seeing activity in the data model matching the following search:

| tstats summariesonly=t latest(log.event_id) AS latest_event, values(log.agent_message) AS log.agent_message, values(log.src_ip) AS log.src_ip count FROM datamodel="pan_firewall" WHERE nodename="log.system.globalprotect" groupby _time log.event_id log.user
| rename log.* as * 
| search event_id="globalprotectportal-auth-succ" 

Essentially, all events matching the WHERE clause: nodename="log.system.globalprotect" stopped after the upgrade.

Has anyone else seen this issue? Does anyone know if there's a fix for this in the works?

panguy
Contributor

Yes, I can confirm this is a breaking update for GlobalProtect.

GlobalProtect now has its own log type. It is no longer apart of the system log type. We will be updating the app and add-on to reflect this change.

Since GlobalProtect has it's own log type, you need to activate log forwarding for GlobalProtect. This can be done at Device -> Log Settings. You will see a new section for GlobalProtect as well as IP-TAG logs. Add a filter to the section to forward logs.

0 Karma

dking8921
New Member

Thanks for confirming. I'd also love a few tips for possibly working around this. Thanks!

0 Karma

AMCollins
Explorer

panguy,

Any ETA on the update for the app and add-on? If it isn't soon, can you provide some good instructions for a work around?

Thanks!

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...