All Apps and Add-ons

PAN-OS 9.1.1 Breaks Data Model?


My network team upgraded our Palo Altos to 9.1.1 and it looks like Palo Alto may have changed the format of GlobalProtect logs... I'm no longer seeing activity in the data model matching the following search:

| tstats summariesonly=t latest(log.event_id) AS latest_event, values(log.agent_message) AS log.agent_message, values(log.src_ip) AS log.src_ip count FROM datamodel="pan_firewall" WHERE nodename="log.system.globalprotect" groupby _time log.event_id log.user
| rename log.* as * 
| search event_id="globalprotectportal-auth-succ" 

Essentially, all events matching the WHERE clause: nodename="log.system.globalprotect" stopped after the upgrade.

Has anyone else seen this issue? Does anyone know if there's a fix for this in the works?


Yes, I can confirm this is a breaking update for GlobalProtect.

GlobalProtect now has its own log type. It is no longer apart of the system log type. We will be updating the app and add-on to reflect this change.

Since GlobalProtect has it's own log type, you need to activate log forwarding for GlobalProtect. This can be done at Device -> Log Settings. You will see a new section for GlobalProtect as well as IP-TAG logs. Add a filter to the section to forward logs.

0 Karma

New Member

Thanks for confirming. I'd also love a few tips for possibly working around this. Thanks!

0 Karma



Any ETA on the update for the app and add-on? If it isn't soon, can you provide some good instructions for a work around?


Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...