All Apps and Add-ons

PAN-OS 9.1.1 Breaks Data Model?

gfisbeck
Explorer

My network team upgraded our Palo Altos to 9.1.1 and it looks like Palo Alto may have changed the format of GlobalProtect logs... I'm no longer seeing activity in the data model matching the following search:

| tstats summariesonly=t latest(log.event_id) AS latest_event, values(log.agent_message) AS log.agent_message, values(log.src_ip) AS log.src_ip count FROM datamodel="pan_firewall" WHERE nodename="log.system.globalprotect" groupby _time log.event_id log.user
| rename log.* as * 
| search event_id="globalprotectportal-auth-succ" 

Essentially, all events matching the WHERE clause: nodename="log.system.globalprotect" stopped after the upgrade.

Has anyone else seen this issue? Does anyone know if there's a fix for this in the works?

panguy
Contributor

Yes, I can confirm this is a breaking update for GlobalProtect.

GlobalProtect now has its own log type. It is no longer apart of the system log type. We will be updating the app and add-on to reflect this change.

Since GlobalProtect has it's own log type, you need to activate log forwarding for GlobalProtect. This can be done at Device -> Log Settings. You will see a new section for GlobalProtect as well as IP-TAG logs. Add a filter to the section to forward logs.

0 Karma

dking8921
New Member

Thanks for confirming. I'd also love a few tips for possibly working around this. Thanks!

0 Karma

AMCollins
Explorer

panguy,

Any ETA on the update for the app and add-on? If it isn't soon, can you provide some good instructions for a work around?

Thanks!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...